Austin Blackstone / Mbed 2 deprecated client-lwip-lightswitch-demo-expanded

mbed client lightswitch demo

Dependencies:   mbed Socket lwip-eth lwip-sys lwip

Fork of mbed-client-classic-example-lwip by Austin Blackstone

mbedtls/source/rsa.c@11:cada08fc8a70, 2016-06-09 (annotated)

Committer:
mbedAustin
Date:
Thu Jun 09 17:08:36 2016 +0000
Revision:
11:cada08fc8a70
Commit for public Consumption

Who changed what in which revision?

UserRevisionLine numberNew contents of line
mbedAustin 11:cada08fc8a70 1 /*
mbedAustin 11:cada08fc8a70 2 * The RSA public-key cryptosystem
mbedAustin 11:cada08fc8a70 3 *
mbedAustin 11:cada08fc8a70 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
mbedAustin 11:cada08fc8a70 5 * SPDX-License-Identifier: Apache-2.0
mbedAustin 11:cada08fc8a70 6 *
mbedAustin 11:cada08fc8a70 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
mbedAustin 11:cada08fc8a70 8 * not use this file except in compliance with the License.
mbedAustin 11:cada08fc8a70 9 * You may obtain a copy of the License at
mbedAustin 11:cada08fc8a70 10 *
mbedAustin 11:cada08fc8a70 11 * http://www.apache.org/licenses/LICENSE-2.0
mbedAustin 11:cada08fc8a70 12 *
mbedAustin 11:cada08fc8a70 13 * Unless required by applicable law or agreed to in writing, software
mbedAustin 11:cada08fc8a70 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
mbedAustin 11:cada08fc8a70 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
mbedAustin 11:cada08fc8a70 16 * See the License for the specific language governing permissions and
mbedAustin 11:cada08fc8a70 17 * limitations under the License.
mbedAustin 11:cada08fc8a70 18 *
mbedAustin 11:cada08fc8a70 19 * This file is part of mbed TLS (https://tls.mbed.org)
mbedAustin 11:cada08fc8a70 20 */
mbedAustin 11:cada08fc8a70 21 /*
mbedAustin 11:cada08fc8a70 22 * RSA was designed by Ron Rivest, Adi Shamir and Len Adleman.
mbedAustin 11:cada08fc8a70 23 *
mbedAustin 11:cada08fc8a70 24 * http://theory.lcs.mit.edu/~rivest/rsapaper.pdf
mbedAustin 11:cada08fc8a70 25 * http://www.cacr.math.uwaterloo.ca/hac/about/chap8.pdf
mbedAustin 11:cada08fc8a70 26 */
mbedAustin 11:cada08fc8a70 27
mbedAustin 11:cada08fc8a70 28 #if !defined(MBEDTLS_CONFIG_FILE)
mbedAustin 11:cada08fc8a70 29 #include "mbedtls/config.h"
mbedAustin 11:cada08fc8a70 30 #else
mbedAustin 11:cada08fc8a70 31 #include MBEDTLS_CONFIG_FILE
mbedAustin 11:cada08fc8a70 32 #endif
mbedAustin 11:cada08fc8a70 33
mbedAustin 11:cada08fc8a70 34 #if defined(MBEDTLS_RSA_C)
mbedAustin 11:cada08fc8a70 35
mbedAustin 11:cada08fc8a70 36 #include "mbedtls/rsa.h"
mbedAustin 11:cada08fc8a70 37 #include "mbedtls/oid.h"
mbedAustin 11:cada08fc8a70 38
mbedAustin 11:cada08fc8a70 39 #include <string.h>
mbedAustin 11:cada08fc8a70 40
mbedAustin 11:cada08fc8a70 41 #if defined(MBEDTLS_PKCS1_V21)
mbedAustin 11:cada08fc8a70 42 #include "mbedtls/md.h"
mbedAustin 11:cada08fc8a70 43 #endif
mbedAustin 11:cada08fc8a70 44
mbedAustin 11:cada08fc8a70 45 #if defined(MBEDTLS_PKCS1_V15) && !defined(__OpenBSD__)
mbedAustin 11:cada08fc8a70 46 #include <stdlib.h>
mbedAustin 11:cada08fc8a70 47 #endif
mbedAustin 11:cada08fc8a70 48
mbedAustin 11:cada08fc8a70 49 #if defined(MBEDTLS_PLATFORM_C)
mbedAustin 11:cada08fc8a70 50 #include "mbedtls/platform.h"
mbedAustin 11:cada08fc8a70 51 #else
mbedAustin 11:cada08fc8a70 52 #include <stdio.h>
mbedAustin 11:cada08fc8a70 53 #define mbedtls_printf printf
mbedAustin 11:cada08fc8a70 54 #define mbedtls_calloc calloc
mbedAustin 11:cada08fc8a70 55 #define mbedtls_free free
mbedAustin 11:cada08fc8a70 56 #endif
mbedAustin 11:cada08fc8a70 57
mbedAustin 11:cada08fc8a70 58 /*
mbedAustin 11:cada08fc8a70 59 * Initialize an RSA context
mbedAustin 11:cada08fc8a70 60 */
mbedAustin 11:cada08fc8a70 61 void mbedtls_rsa_init( mbedtls_rsa_context *ctx,
mbedAustin 11:cada08fc8a70 62 int padding,
mbedAustin 11:cada08fc8a70 63 int hash_id )
mbedAustin 11:cada08fc8a70 64 {
mbedAustin 11:cada08fc8a70 65 memset( ctx, 0, sizeof( mbedtls_rsa_context ) );
mbedAustin 11:cada08fc8a70 66
mbedAustin 11:cada08fc8a70 67 mbedtls_rsa_set_padding( ctx, padding, hash_id );
mbedAustin 11:cada08fc8a70 68
mbedAustin 11:cada08fc8a70 69 #if defined(MBEDTLS_THREADING_C)
mbedAustin 11:cada08fc8a70 70 mbedtls_mutex_init( &ctx->mutex );
mbedAustin 11:cada08fc8a70 71 #endif
mbedAustin 11:cada08fc8a70 72 }
mbedAustin 11:cada08fc8a70 73
mbedAustin 11:cada08fc8a70 74 /*
mbedAustin 11:cada08fc8a70 75 * Set padding for an existing RSA context
mbedAustin 11:cada08fc8a70 76 */
mbedAustin 11:cada08fc8a70 77 void mbedtls_rsa_set_padding( mbedtls_rsa_context *ctx, int padding, int hash_id )
mbedAustin 11:cada08fc8a70 78 {
mbedAustin 11:cada08fc8a70 79 ctx->padding = padding;
mbedAustin 11:cada08fc8a70 80 ctx->hash_id = hash_id;
mbedAustin 11:cada08fc8a70 81 }
mbedAustin 11:cada08fc8a70 82
mbedAustin 11:cada08fc8a70 83 #if defined(MBEDTLS_GENPRIME)
mbedAustin 11:cada08fc8a70 84
mbedAustin 11:cada08fc8a70 85 /*
mbedAustin 11:cada08fc8a70 86 * Generate an RSA keypair
mbedAustin 11:cada08fc8a70 87 */
mbedAustin 11:cada08fc8a70 88 int mbedtls_rsa_gen_key( mbedtls_rsa_context *ctx,
mbedAustin 11:cada08fc8a70 89 int (*f_rng)(void *, unsigned char *, size_t),
mbedAustin 11:cada08fc8a70 90 void *p_rng,
mbedAustin 11:cada08fc8a70 91 unsigned int nbits, int exponent )
mbedAustin 11:cada08fc8a70 92 {
mbedAustin 11:cada08fc8a70 93 int ret;
mbedAustin 11:cada08fc8a70 94 mbedtls_mpi P1, Q1, H, G;
mbedAustin 11:cada08fc8a70 95
mbedAustin 11:cada08fc8a70 96 if( f_rng == NULL || nbits < 128 || exponent < 3 )
mbedAustin 11:cada08fc8a70 97 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 98
mbedAustin 11:cada08fc8a70 99 mbedtls_mpi_init( &P1 ); mbedtls_mpi_init( &Q1 ); mbedtls_mpi_init( &H ); mbedtls_mpi_init( &G );
mbedAustin 11:cada08fc8a70 100
mbedAustin 11:cada08fc8a70 101 /*
mbedAustin 11:cada08fc8a70 102 * find primes P and Q with Q < P so that:
mbedAustin 11:cada08fc8a70 103 * GCD( E, (P-1)*(Q-1) ) == 1
mbedAustin 11:cada08fc8a70 104 */
mbedAustin 11:cada08fc8a70 105 MBEDTLS_MPI_CHK( mbedtls_mpi_lset( &ctx->E, exponent ) );
mbedAustin 11:cada08fc8a70 106
mbedAustin 11:cada08fc8a70 107 do
mbedAustin 11:cada08fc8a70 108 {
mbedAustin 11:cada08fc8a70 109 MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->P, ( nbits + 1 ) >> 1, 0,
mbedAustin 11:cada08fc8a70 110 f_rng, p_rng ) );
mbedAustin 11:cada08fc8a70 111
mbedAustin 11:cada08fc8a70 112 MBEDTLS_MPI_CHK( mbedtls_mpi_gen_prime( &ctx->Q, ( nbits + 1 ) >> 1, 0,
mbedAustin 11:cada08fc8a70 113 f_rng, p_rng ) );
mbedAustin 11:cada08fc8a70 114
mbedAustin 11:cada08fc8a70 115 if( mbedtls_mpi_cmp_mpi( &ctx->P, &ctx->Q ) < 0 )
mbedAustin 11:cada08fc8a70 116 mbedtls_mpi_swap( &ctx->P, &ctx->Q );
mbedAustin 11:cada08fc8a70 117
mbedAustin 11:cada08fc8a70 118 if( mbedtls_mpi_cmp_mpi( &ctx->P, &ctx->Q ) == 0 )
mbedAustin 11:cada08fc8a70 119 continue;
mbedAustin 11:cada08fc8a70 120
mbedAustin 11:cada08fc8a70 121 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->N, &ctx->P, &ctx->Q ) );
mbedAustin 11:cada08fc8a70 122 if( mbedtls_mpi_bitlen( &ctx->N ) != nbits )
mbedAustin 11:cada08fc8a70 123 continue;
mbedAustin 11:cada08fc8a70 124
mbedAustin 11:cada08fc8a70 125 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &P1, &ctx->P, 1 ) );
mbedAustin 11:cada08fc8a70 126 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &Q1, &ctx->Q, 1 ) );
mbedAustin 11:cada08fc8a70 127 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &H, &P1, &Q1 ) );
mbedAustin 11:cada08fc8a70 128 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G, &ctx->E, &H ) );
mbedAustin 11:cada08fc8a70 129 }
mbedAustin 11:cada08fc8a70 130 while( mbedtls_mpi_cmp_int( &G, 1 ) != 0 );
mbedAustin 11:cada08fc8a70 131
mbedAustin 11:cada08fc8a70 132 /*
mbedAustin 11:cada08fc8a70 133 * D = E^-1 mod ((P-1)*(Q-1))
mbedAustin 11:cada08fc8a70 134 * DP = D mod (P - 1)
mbedAustin 11:cada08fc8a70 135 * DQ = D mod (Q - 1)
mbedAustin 11:cada08fc8a70 136 * QP = Q^-1 mod P
mbedAustin 11:cada08fc8a70 137 */
mbedAustin 11:cada08fc8a70 138 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->D , &ctx->E, &H ) );
mbedAustin 11:cada08fc8a70 139 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->DP, &ctx->D, &P1 ) );
mbedAustin 11:cada08fc8a70 140 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->DQ, &ctx->D, &Q1 ) );
mbedAustin 11:cada08fc8a70 141 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->QP, &ctx->Q, &ctx->P ) );
mbedAustin 11:cada08fc8a70 142
mbedAustin 11:cada08fc8a70 143 ctx->len = ( mbedtls_mpi_bitlen( &ctx->N ) + 7 ) >> 3;
mbedAustin 11:cada08fc8a70 144
mbedAustin 11:cada08fc8a70 145 cleanup:
mbedAustin 11:cada08fc8a70 146
mbedAustin 11:cada08fc8a70 147 mbedtls_mpi_free( &P1 ); mbedtls_mpi_free( &Q1 ); mbedtls_mpi_free( &H ); mbedtls_mpi_free( &G );
mbedAustin 11:cada08fc8a70 148
mbedAustin 11:cada08fc8a70 149 if( ret != 0 )
mbedAustin 11:cada08fc8a70 150 {
mbedAustin 11:cada08fc8a70 151 mbedtls_rsa_free( ctx );
mbedAustin 11:cada08fc8a70 152 return( MBEDTLS_ERR_RSA_KEY_GEN_FAILED + ret );
mbedAustin 11:cada08fc8a70 153 }
mbedAustin 11:cada08fc8a70 154
mbedAustin 11:cada08fc8a70 155 return( 0 );
mbedAustin 11:cada08fc8a70 156 }
mbedAustin 11:cada08fc8a70 157
mbedAustin 11:cada08fc8a70 158 #endif /* MBEDTLS_GENPRIME */
mbedAustin 11:cada08fc8a70 159
mbedAustin 11:cada08fc8a70 160 /*
mbedAustin 11:cada08fc8a70 161 * Check a public RSA key
mbedAustin 11:cada08fc8a70 162 */
mbedAustin 11:cada08fc8a70 163 int mbedtls_rsa_check_pubkey( const mbedtls_rsa_context *ctx )
mbedAustin 11:cada08fc8a70 164 {
mbedAustin 11:cada08fc8a70 165 if( !ctx->N.p || !ctx->E.p )
mbedAustin 11:cada08fc8a70 166 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
mbedAustin 11:cada08fc8a70 167
mbedAustin 11:cada08fc8a70 168 if( ( ctx->N.p[0] & 1 ) == 0 ||
mbedAustin 11:cada08fc8a70 169 ( ctx->E.p[0] & 1 ) == 0 )
mbedAustin 11:cada08fc8a70 170 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
mbedAustin 11:cada08fc8a70 171
mbedAustin 11:cada08fc8a70 172 if( mbedtls_mpi_bitlen( &ctx->N ) < 128 ||
mbedAustin 11:cada08fc8a70 173 mbedtls_mpi_bitlen( &ctx->N ) > MBEDTLS_MPI_MAX_BITS )
mbedAustin 11:cada08fc8a70 174 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
mbedAustin 11:cada08fc8a70 175
mbedAustin 11:cada08fc8a70 176 if( mbedtls_mpi_bitlen( &ctx->E ) < 2 ||
mbedAustin 11:cada08fc8a70 177 mbedtls_mpi_cmp_mpi( &ctx->E, &ctx->N ) >= 0 )
mbedAustin 11:cada08fc8a70 178 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
mbedAustin 11:cada08fc8a70 179
mbedAustin 11:cada08fc8a70 180 return( 0 );
mbedAustin 11:cada08fc8a70 181 }
mbedAustin 11:cada08fc8a70 182
mbedAustin 11:cada08fc8a70 183 /*
mbedAustin 11:cada08fc8a70 184 * Check a private RSA key
mbedAustin 11:cada08fc8a70 185 */
mbedAustin 11:cada08fc8a70 186 int mbedtls_rsa_check_privkey( const mbedtls_rsa_context *ctx )
mbedAustin 11:cada08fc8a70 187 {
mbedAustin 11:cada08fc8a70 188 int ret;
mbedAustin 11:cada08fc8a70 189 mbedtls_mpi PQ, DE, P1, Q1, H, I, G, G2, L1, L2, DP, DQ, QP;
mbedAustin 11:cada08fc8a70 190
mbedAustin 11:cada08fc8a70 191 if( ( ret = mbedtls_rsa_check_pubkey( ctx ) ) != 0 )
mbedAustin 11:cada08fc8a70 192 return( ret );
mbedAustin 11:cada08fc8a70 193
mbedAustin 11:cada08fc8a70 194 if( !ctx->P.p || !ctx->Q.p || !ctx->D.p )
mbedAustin 11:cada08fc8a70 195 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
mbedAustin 11:cada08fc8a70 196
mbedAustin 11:cada08fc8a70 197 mbedtls_mpi_init( &PQ ); mbedtls_mpi_init( &DE ); mbedtls_mpi_init( &P1 ); mbedtls_mpi_init( &Q1 );
mbedAustin 11:cada08fc8a70 198 mbedtls_mpi_init( &H ); mbedtls_mpi_init( &I ); mbedtls_mpi_init( &G ); mbedtls_mpi_init( &G2 );
mbedAustin 11:cada08fc8a70 199 mbedtls_mpi_init( &L1 ); mbedtls_mpi_init( &L2 ); mbedtls_mpi_init( &DP ); mbedtls_mpi_init( &DQ );
mbedAustin 11:cada08fc8a70 200 mbedtls_mpi_init( &QP );
mbedAustin 11:cada08fc8a70 201
mbedAustin 11:cada08fc8a70 202 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &PQ, &ctx->P, &ctx->Q ) );
mbedAustin 11:cada08fc8a70 203 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &DE, &ctx->D, &ctx->E ) );
mbedAustin 11:cada08fc8a70 204 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &P1, &ctx->P, 1 ) );
mbedAustin 11:cada08fc8a70 205 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &Q1, &ctx->Q, 1 ) );
mbedAustin 11:cada08fc8a70 206 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &H, &P1, &Q1 ) );
mbedAustin 11:cada08fc8a70 207 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G, &ctx->E, &H ) );
mbedAustin 11:cada08fc8a70 208
mbedAustin 11:cada08fc8a70 209 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &G2, &P1, &Q1 ) );
mbedAustin 11:cada08fc8a70 210 MBEDTLS_MPI_CHK( mbedtls_mpi_div_mpi( &L1, &L2, &H, &G2 ) );
mbedAustin 11:cada08fc8a70 211 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &I, &DE, &L1 ) );
mbedAustin 11:cada08fc8a70 212
mbedAustin 11:cada08fc8a70 213 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &DP, &ctx->D, &P1 ) );
mbedAustin 11:cada08fc8a70 214 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &DQ, &ctx->D, &Q1 ) );
mbedAustin 11:cada08fc8a70 215 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &QP, &ctx->Q, &ctx->P ) );
mbedAustin 11:cada08fc8a70 216 /*
mbedAustin 11:cada08fc8a70 217 * Check for a valid PKCS1v2 private key
mbedAustin 11:cada08fc8a70 218 */
mbedAustin 11:cada08fc8a70 219 if( mbedtls_mpi_cmp_mpi( &PQ, &ctx->N ) != 0 ||
mbedAustin 11:cada08fc8a70 220 mbedtls_mpi_cmp_mpi( &DP, &ctx->DP ) != 0 ||
mbedAustin 11:cada08fc8a70 221 mbedtls_mpi_cmp_mpi( &DQ, &ctx->DQ ) != 0 ||
mbedAustin 11:cada08fc8a70 222 mbedtls_mpi_cmp_mpi( &QP, &ctx->QP ) != 0 ||
mbedAustin 11:cada08fc8a70 223 mbedtls_mpi_cmp_int( &L2, 0 ) != 0 ||
mbedAustin 11:cada08fc8a70 224 mbedtls_mpi_cmp_int( &I, 1 ) != 0 ||
mbedAustin 11:cada08fc8a70 225 mbedtls_mpi_cmp_int( &G, 1 ) != 0 )
mbedAustin 11:cada08fc8a70 226 {
mbedAustin 11:cada08fc8a70 227 ret = MBEDTLS_ERR_RSA_KEY_CHECK_FAILED;
mbedAustin 11:cada08fc8a70 228 }
mbedAustin 11:cada08fc8a70 229
mbedAustin 11:cada08fc8a70 230 cleanup:
mbedAustin 11:cada08fc8a70 231 mbedtls_mpi_free( &PQ ); mbedtls_mpi_free( &DE ); mbedtls_mpi_free( &P1 ); mbedtls_mpi_free( &Q1 );
mbedAustin 11:cada08fc8a70 232 mbedtls_mpi_free( &H ); mbedtls_mpi_free( &I ); mbedtls_mpi_free( &G ); mbedtls_mpi_free( &G2 );
mbedAustin 11:cada08fc8a70 233 mbedtls_mpi_free( &L1 ); mbedtls_mpi_free( &L2 ); mbedtls_mpi_free( &DP ); mbedtls_mpi_free( &DQ );
mbedAustin 11:cada08fc8a70 234 mbedtls_mpi_free( &QP );
mbedAustin 11:cada08fc8a70 235
mbedAustin 11:cada08fc8a70 236 if( ret == MBEDTLS_ERR_RSA_KEY_CHECK_FAILED )
mbedAustin 11:cada08fc8a70 237 return( ret );
mbedAustin 11:cada08fc8a70 238
mbedAustin 11:cada08fc8a70 239 if( ret != 0 )
mbedAustin 11:cada08fc8a70 240 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED + ret );
mbedAustin 11:cada08fc8a70 241
mbedAustin 11:cada08fc8a70 242 return( 0 );
mbedAustin 11:cada08fc8a70 243 }
mbedAustin 11:cada08fc8a70 244
mbedAustin 11:cada08fc8a70 245 /*
mbedAustin 11:cada08fc8a70 246 * Check if contexts holding a public and private key match
mbedAustin 11:cada08fc8a70 247 */
mbedAustin 11:cada08fc8a70 248 int mbedtls_rsa_check_pub_priv( const mbedtls_rsa_context *pub, const mbedtls_rsa_context *prv )
mbedAustin 11:cada08fc8a70 249 {
mbedAustin 11:cada08fc8a70 250 if( mbedtls_rsa_check_pubkey( pub ) != 0 ||
mbedAustin 11:cada08fc8a70 251 mbedtls_rsa_check_privkey( prv ) != 0 )
mbedAustin 11:cada08fc8a70 252 {
mbedAustin 11:cada08fc8a70 253 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
mbedAustin 11:cada08fc8a70 254 }
mbedAustin 11:cada08fc8a70 255
mbedAustin 11:cada08fc8a70 256 if( mbedtls_mpi_cmp_mpi( &pub->N, &prv->N ) != 0 ||
mbedAustin 11:cada08fc8a70 257 mbedtls_mpi_cmp_mpi( &pub->E, &prv->E ) != 0 )
mbedAustin 11:cada08fc8a70 258 {
mbedAustin 11:cada08fc8a70 259 return( MBEDTLS_ERR_RSA_KEY_CHECK_FAILED );
mbedAustin 11:cada08fc8a70 260 }
mbedAustin 11:cada08fc8a70 261
mbedAustin 11:cada08fc8a70 262 return( 0 );
mbedAustin 11:cada08fc8a70 263 }
mbedAustin 11:cada08fc8a70 264
mbedAustin 11:cada08fc8a70 265 /*
mbedAustin 11:cada08fc8a70 266 * Do an RSA public key operation
mbedAustin 11:cada08fc8a70 267 */
mbedAustin 11:cada08fc8a70 268 int mbedtls_rsa_public( mbedtls_rsa_context *ctx,
mbedAustin 11:cada08fc8a70 269 const unsigned char *input,
mbedAustin 11:cada08fc8a70 270 unsigned char *output )
mbedAustin 11:cada08fc8a70 271 {
mbedAustin 11:cada08fc8a70 272 int ret;
mbedAustin 11:cada08fc8a70 273 size_t olen;
mbedAustin 11:cada08fc8a70 274 mbedtls_mpi T;
mbedAustin 11:cada08fc8a70 275
mbedAustin 11:cada08fc8a70 276 mbedtls_mpi_init( &T );
mbedAustin 11:cada08fc8a70 277
mbedAustin 11:cada08fc8a70 278 #if defined(MBEDTLS_THREADING_C)
mbedAustin 11:cada08fc8a70 279 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
mbedAustin 11:cada08fc8a70 280 return( ret );
mbedAustin 11:cada08fc8a70 281 #endif
mbedAustin 11:cada08fc8a70 282
mbedAustin 11:cada08fc8a70 283 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &T, input, ctx->len ) );
mbedAustin 11:cada08fc8a70 284
mbedAustin 11:cada08fc8a70 285 if( mbedtls_mpi_cmp_mpi( &T, &ctx->N ) >= 0 )
mbedAustin 11:cada08fc8a70 286 {
mbedAustin 11:cada08fc8a70 287 ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
mbedAustin 11:cada08fc8a70 288 goto cleanup;
mbedAustin 11:cada08fc8a70 289 }
mbedAustin 11:cada08fc8a70 290
mbedAustin 11:cada08fc8a70 291 olen = ctx->len;
mbedAustin 11:cada08fc8a70 292 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T, &T, &ctx->E, &ctx->N, &ctx->RN ) );
mbedAustin 11:cada08fc8a70 293 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &T, output, olen ) );
mbedAustin 11:cada08fc8a70 294
mbedAustin 11:cada08fc8a70 295 cleanup:
mbedAustin 11:cada08fc8a70 296 #if defined(MBEDTLS_THREADING_C)
mbedAustin 11:cada08fc8a70 297 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
mbedAustin 11:cada08fc8a70 298 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
mbedAustin 11:cada08fc8a70 299 #endif
mbedAustin 11:cada08fc8a70 300
mbedAustin 11:cada08fc8a70 301 mbedtls_mpi_free( &T );
mbedAustin 11:cada08fc8a70 302
mbedAustin 11:cada08fc8a70 303 if( ret != 0 )
mbedAustin 11:cada08fc8a70 304 return( MBEDTLS_ERR_RSA_PUBLIC_FAILED + ret );
mbedAustin 11:cada08fc8a70 305
mbedAustin 11:cada08fc8a70 306 return( 0 );
mbedAustin 11:cada08fc8a70 307 }
mbedAustin 11:cada08fc8a70 308
mbedAustin 11:cada08fc8a70 309 /*
mbedAustin 11:cada08fc8a70 310 * Generate or update blinding values, see section 10 of:
mbedAustin 11:cada08fc8a70 311 * KOCHER, Paul C. Timing attacks on implementations of Diffie-Hellman, RSA,
mbedAustin 11:cada08fc8a70 312 * DSS, and other systems. In : Advances in Cryptology-CRYPTO'96. Springer
mbedAustin 11:cada08fc8a70 313 * Berlin Heidelberg, 1996. p. 104-113.
mbedAustin 11:cada08fc8a70 314 */
mbedAustin 11:cada08fc8a70 315 static int rsa_prepare_blinding( mbedtls_rsa_context *ctx,
mbedAustin 11:cada08fc8a70 316 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
mbedAustin 11:cada08fc8a70 317 {
mbedAustin 11:cada08fc8a70 318 int ret, count = 0;
mbedAustin 11:cada08fc8a70 319
mbedAustin 11:cada08fc8a70 320 if( ctx->Vf.p != NULL )
mbedAustin 11:cada08fc8a70 321 {
mbedAustin 11:cada08fc8a70 322 /* We already have blinding values, just update them by squaring */
mbedAustin 11:cada08fc8a70 323 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vi, &ctx->Vi, &ctx->Vi ) );
mbedAustin 11:cada08fc8a70 324 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vi, &ctx->Vi, &ctx->N ) );
mbedAustin 11:cada08fc8a70 325 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &ctx->Vf, &ctx->Vf, &ctx->Vf ) );
mbedAustin 11:cada08fc8a70 326 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &ctx->Vf, &ctx->Vf, &ctx->N ) );
mbedAustin 11:cada08fc8a70 327
mbedAustin 11:cada08fc8a70 328 goto cleanup;
mbedAustin 11:cada08fc8a70 329 }
mbedAustin 11:cada08fc8a70 330
mbedAustin 11:cada08fc8a70 331 /* Unblinding value: Vf = random number, invertible mod N */
mbedAustin 11:cada08fc8a70 332 do {
mbedAustin 11:cada08fc8a70 333 if( count++ > 10 )
mbedAustin 11:cada08fc8a70 334 return( MBEDTLS_ERR_RSA_RNG_FAILED );
mbedAustin 11:cada08fc8a70 335
mbedAustin 11:cada08fc8a70 336 MBEDTLS_MPI_CHK( mbedtls_mpi_fill_random( &ctx->Vf, ctx->len - 1, f_rng, p_rng ) );
mbedAustin 11:cada08fc8a70 337 MBEDTLS_MPI_CHK( mbedtls_mpi_gcd( &ctx->Vi, &ctx->Vf, &ctx->N ) );
mbedAustin 11:cada08fc8a70 338 } while( mbedtls_mpi_cmp_int( &ctx->Vi, 1 ) != 0 );
mbedAustin 11:cada08fc8a70 339
mbedAustin 11:cada08fc8a70 340 /* Blinding value: Vi = Vf^(-e) mod N */
mbedAustin 11:cada08fc8a70 341 MBEDTLS_MPI_CHK( mbedtls_mpi_inv_mod( &ctx->Vi, &ctx->Vf, &ctx->N ) );
mbedAustin 11:cada08fc8a70 342 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &ctx->Vi, &ctx->Vi, &ctx->E, &ctx->N, &ctx->RN ) );
mbedAustin 11:cada08fc8a70 343
mbedAustin 11:cada08fc8a70 344
mbedAustin 11:cada08fc8a70 345 cleanup:
mbedAustin 11:cada08fc8a70 346 return( ret );
mbedAustin 11:cada08fc8a70 347 }
mbedAustin 11:cada08fc8a70 348
mbedAustin 11:cada08fc8a70 349 /*
mbedAustin 11:cada08fc8a70 350 * Do an RSA private key operation
mbedAustin 11:cada08fc8a70 351 */
mbedAustin 11:cada08fc8a70 352 int mbedtls_rsa_private( mbedtls_rsa_context *ctx,
mbedAustin 11:cada08fc8a70 353 int (*f_rng)(void *, unsigned char *, size_t),
mbedAustin 11:cada08fc8a70 354 void *p_rng,
mbedAustin 11:cada08fc8a70 355 const unsigned char *input,
mbedAustin 11:cada08fc8a70 356 unsigned char *output )
mbedAustin 11:cada08fc8a70 357 {
mbedAustin 11:cada08fc8a70 358 int ret;
mbedAustin 11:cada08fc8a70 359 size_t olen;
mbedAustin 11:cada08fc8a70 360 mbedtls_mpi T, T1, T2;
mbedAustin 11:cada08fc8a70 361
mbedAustin 11:cada08fc8a70 362 /* Make sure we have private key info, prevent possible misuse */
mbedAustin 11:cada08fc8a70 363 if( ctx->P.p == NULL || ctx->Q.p == NULL || ctx->D.p == NULL )
mbedAustin 11:cada08fc8a70 364 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 365
mbedAustin 11:cada08fc8a70 366 mbedtls_mpi_init( &T ); mbedtls_mpi_init( &T1 ); mbedtls_mpi_init( &T2 );
mbedAustin 11:cada08fc8a70 367
mbedAustin 11:cada08fc8a70 368 #if defined(MBEDTLS_THREADING_C)
mbedAustin 11:cada08fc8a70 369 if( ( ret = mbedtls_mutex_lock( &ctx->mutex ) ) != 0 )
mbedAustin 11:cada08fc8a70 370 return( ret );
mbedAustin 11:cada08fc8a70 371 #endif
mbedAustin 11:cada08fc8a70 372
mbedAustin 11:cada08fc8a70 373 MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &T, input, ctx->len ) );
mbedAustin 11:cada08fc8a70 374 if( mbedtls_mpi_cmp_mpi( &T, &ctx->N ) >= 0 )
mbedAustin 11:cada08fc8a70 375 {
mbedAustin 11:cada08fc8a70 376 ret = MBEDTLS_ERR_MPI_BAD_INPUT_DATA;
mbedAustin 11:cada08fc8a70 377 goto cleanup;
mbedAustin 11:cada08fc8a70 378 }
mbedAustin 11:cada08fc8a70 379
mbedAustin 11:cada08fc8a70 380 if( f_rng != NULL )
mbedAustin 11:cada08fc8a70 381 {
mbedAustin 11:cada08fc8a70 382 /*
mbedAustin 11:cada08fc8a70 383 * Blinding
mbedAustin 11:cada08fc8a70 384 * T = T * Vi mod N
mbedAustin 11:cada08fc8a70 385 */
mbedAustin 11:cada08fc8a70 386 MBEDTLS_MPI_CHK( rsa_prepare_blinding( ctx, f_rng, p_rng ) );
mbedAustin 11:cada08fc8a70 387 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &T, &ctx->Vi ) );
mbedAustin 11:cada08fc8a70 388 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T, &ctx->N ) );
mbedAustin 11:cada08fc8a70 389 }
mbedAustin 11:cada08fc8a70 390
mbedAustin 11:cada08fc8a70 391 #if defined(MBEDTLS_RSA_NO_CRT)
mbedAustin 11:cada08fc8a70 392 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T, &T, &ctx->D, &ctx->N, &ctx->RN ) );
mbedAustin 11:cada08fc8a70 393 #else
mbedAustin 11:cada08fc8a70 394 /*
mbedAustin 11:cada08fc8a70 395 * faster decryption using the CRT
mbedAustin 11:cada08fc8a70 396 *
mbedAustin 11:cada08fc8a70 397 * T1 = input ^ dP mod P
mbedAustin 11:cada08fc8a70 398 * T2 = input ^ dQ mod Q
mbedAustin 11:cada08fc8a70 399 */
mbedAustin 11:cada08fc8a70 400 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T1, &T, &ctx->DP, &ctx->P, &ctx->RP ) );
mbedAustin 11:cada08fc8a70 401 MBEDTLS_MPI_CHK( mbedtls_mpi_exp_mod( &T2, &T, &ctx->DQ, &ctx->Q, &ctx->RQ ) );
mbedAustin 11:cada08fc8a70 402
mbedAustin 11:cada08fc8a70 403 /*
mbedAustin 11:cada08fc8a70 404 * T = (T1 - T2) * (Q^-1 mod P) mod P
mbedAustin 11:cada08fc8a70 405 */
mbedAustin 11:cada08fc8a70 406 MBEDTLS_MPI_CHK( mbedtls_mpi_sub_mpi( &T, &T1, &T2 ) );
mbedAustin 11:cada08fc8a70 407 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T1, &T, &ctx->QP ) );
mbedAustin 11:cada08fc8a70 408 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T1, &ctx->P ) );
mbedAustin 11:cada08fc8a70 409
mbedAustin 11:cada08fc8a70 410 /*
mbedAustin 11:cada08fc8a70 411 * T = T2 + T * Q
mbedAustin 11:cada08fc8a70 412 */
mbedAustin 11:cada08fc8a70 413 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T1, &T, &ctx->Q ) );
mbedAustin 11:cada08fc8a70 414 MBEDTLS_MPI_CHK( mbedtls_mpi_add_mpi( &T, &T2, &T1 ) );
mbedAustin 11:cada08fc8a70 415 #endif /* MBEDTLS_RSA_NO_CRT */
mbedAustin 11:cada08fc8a70 416
mbedAustin 11:cada08fc8a70 417 if( f_rng != NULL )
mbedAustin 11:cada08fc8a70 418 {
mbedAustin 11:cada08fc8a70 419 /*
mbedAustin 11:cada08fc8a70 420 * Unblind
mbedAustin 11:cada08fc8a70 421 * T = T * Vf mod N
mbedAustin 11:cada08fc8a70 422 */
mbedAustin 11:cada08fc8a70 423 MBEDTLS_MPI_CHK( mbedtls_mpi_mul_mpi( &T, &T, &ctx->Vf ) );
mbedAustin 11:cada08fc8a70 424 MBEDTLS_MPI_CHK( mbedtls_mpi_mod_mpi( &T, &T, &ctx->N ) );
mbedAustin 11:cada08fc8a70 425 }
mbedAustin 11:cada08fc8a70 426
mbedAustin 11:cada08fc8a70 427 olen = ctx->len;
mbedAustin 11:cada08fc8a70 428 MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &T, output, olen ) );
mbedAustin 11:cada08fc8a70 429
mbedAustin 11:cada08fc8a70 430 cleanup:
mbedAustin 11:cada08fc8a70 431 #if defined(MBEDTLS_THREADING_C)
mbedAustin 11:cada08fc8a70 432 if( mbedtls_mutex_unlock( &ctx->mutex ) != 0 )
mbedAustin 11:cada08fc8a70 433 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
mbedAustin 11:cada08fc8a70 434 #endif
mbedAustin 11:cada08fc8a70 435
mbedAustin 11:cada08fc8a70 436 mbedtls_mpi_free( &T ); mbedtls_mpi_free( &T1 ); mbedtls_mpi_free( &T2 );
mbedAustin 11:cada08fc8a70 437
mbedAustin 11:cada08fc8a70 438 if( ret != 0 )
mbedAustin 11:cada08fc8a70 439 return( MBEDTLS_ERR_RSA_PRIVATE_FAILED + ret );
mbedAustin 11:cada08fc8a70 440
mbedAustin 11:cada08fc8a70 441 return( 0 );
mbedAustin 11:cada08fc8a70 442 }
mbedAustin 11:cada08fc8a70 443
mbedAustin 11:cada08fc8a70 444 #if defined(MBEDTLS_PKCS1_V21)
mbedAustin 11:cada08fc8a70 445 /**
mbedAustin 11:cada08fc8a70 446 * Generate and apply the MGF1 operation (from PKCS#1 v2.1) to a buffer.
mbedAustin 11:cada08fc8a70 447 *
mbedAustin 11:cada08fc8a70 448 * \param dst buffer to mask
mbedAustin 11:cada08fc8a70 449 * \param dlen length of destination buffer
mbedAustin 11:cada08fc8a70 450 * \param src source of the mask generation
mbedAustin 11:cada08fc8a70 451 * \param slen length of the source buffer
mbedAustin 11:cada08fc8a70 452 * \param md_ctx message digest context to use
mbedAustin 11:cada08fc8a70 453 */
mbedAustin 11:cada08fc8a70 454 static void mgf_mask( unsigned char *dst, size_t dlen, unsigned char *src,
mbedAustin 11:cada08fc8a70 455 size_t slen, mbedtls_md_context_t *md_ctx )
mbedAustin 11:cada08fc8a70 456 {
mbedAustin 11:cada08fc8a70 457 unsigned char mask[MBEDTLS_MD_MAX_SIZE];
mbedAustin 11:cada08fc8a70 458 unsigned char counter[4];
mbedAustin 11:cada08fc8a70 459 unsigned char *p;
mbedAustin 11:cada08fc8a70 460 unsigned int hlen;
mbedAustin 11:cada08fc8a70 461 size_t i, use_len;
mbedAustin 11:cada08fc8a70 462
mbedAustin 11:cada08fc8a70 463 memset( mask, 0, MBEDTLS_MD_MAX_SIZE );
mbedAustin 11:cada08fc8a70 464 memset( counter, 0, 4 );
mbedAustin 11:cada08fc8a70 465
mbedAustin 11:cada08fc8a70 466 hlen = mbedtls_md_get_size( md_ctx->md_info );
mbedAustin 11:cada08fc8a70 467
mbedAustin 11:cada08fc8a70 468 // Generate and apply dbMask
mbedAustin 11:cada08fc8a70 469 //
mbedAustin 11:cada08fc8a70 470 p = dst;
mbedAustin 11:cada08fc8a70 471
mbedAustin 11:cada08fc8a70 472 while( dlen > 0 )
mbedAustin 11:cada08fc8a70 473 {
mbedAustin 11:cada08fc8a70 474 use_len = hlen;
mbedAustin 11:cada08fc8a70 475 if( dlen < hlen )
mbedAustin 11:cada08fc8a70 476 use_len = dlen;
mbedAustin 11:cada08fc8a70 477
mbedAustin 11:cada08fc8a70 478 mbedtls_md_starts( md_ctx );
mbedAustin 11:cada08fc8a70 479 mbedtls_md_update( md_ctx, src, slen );
mbedAustin 11:cada08fc8a70 480 mbedtls_md_update( md_ctx, counter, 4 );
mbedAustin 11:cada08fc8a70 481 mbedtls_md_finish( md_ctx, mask );
mbedAustin 11:cada08fc8a70 482
mbedAustin 11:cada08fc8a70 483 for( i = 0; i < use_len; ++i )
mbedAustin 11:cada08fc8a70 484 *p++ ^= mask[i];
mbedAustin 11:cada08fc8a70 485
mbedAustin 11:cada08fc8a70 486 counter[3]++;
mbedAustin 11:cada08fc8a70 487
mbedAustin 11:cada08fc8a70 488 dlen -= use_len;
mbedAustin 11:cada08fc8a70 489 }
mbedAustin 11:cada08fc8a70 490 }
mbedAustin 11:cada08fc8a70 491 #endif /* MBEDTLS_PKCS1_V21 */
mbedAustin 11:cada08fc8a70 492
mbedAustin 11:cada08fc8a70 493 #if defined(MBEDTLS_PKCS1_V21)
mbedAustin 11:cada08fc8a70 494 /*
mbedAustin 11:cada08fc8a70 495 * Implementation of the PKCS#1 v2.1 RSAES-OAEP-ENCRYPT function
mbedAustin 11:cada08fc8a70 496 */
mbedAustin 11:cada08fc8a70 497 int mbedtls_rsa_rsaes_oaep_encrypt( mbedtls_rsa_context *ctx,
mbedAustin 11:cada08fc8a70 498 int (*f_rng)(void *, unsigned char *, size_t),
mbedAustin 11:cada08fc8a70 499 void *p_rng,
mbedAustin 11:cada08fc8a70 500 int mode,
mbedAustin 11:cada08fc8a70 501 const unsigned char *label, size_t label_len,
mbedAustin 11:cada08fc8a70 502 size_t ilen,
mbedAustin 11:cada08fc8a70 503 const unsigned char *input,
mbedAustin 11:cada08fc8a70 504 unsigned char *output )
mbedAustin 11:cada08fc8a70 505 {
mbedAustin 11:cada08fc8a70 506 size_t olen;
mbedAustin 11:cada08fc8a70 507 int ret;
mbedAustin 11:cada08fc8a70 508 unsigned char *p = output;
mbedAustin 11:cada08fc8a70 509 unsigned int hlen;
mbedAustin 11:cada08fc8a70 510 const mbedtls_md_info_t *md_info;
mbedAustin 11:cada08fc8a70 511 mbedtls_md_context_t md_ctx;
mbedAustin 11:cada08fc8a70 512
mbedAustin 11:cada08fc8a70 513 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
mbedAustin 11:cada08fc8a70 514 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 515
mbedAustin 11:cada08fc8a70 516 if( f_rng == NULL )
mbedAustin 11:cada08fc8a70 517 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 518
mbedAustin 11:cada08fc8a70 519 md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
mbedAustin 11:cada08fc8a70 520 if( md_info == NULL )
mbedAustin 11:cada08fc8a70 521 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 522
mbedAustin 11:cada08fc8a70 523 olen = ctx->len;
mbedAustin 11:cada08fc8a70 524 hlen = mbedtls_md_get_size( md_info );
mbedAustin 11:cada08fc8a70 525
mbedAustin 11:cada08fc8a70 526 if( olen < ilen + 2 * hlen + 2 )
mbedAustin 11:cada08fc8a70 527 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 528
mbedAustin 11:cada08fc8a70 529 memset( output, 0, olen );
mbedAustin 11:cada08fc8a70 530
mbedAustin 11:cada08fc8a70 531 *p++ = 0;
mbedAustin 11:cada08fc8a70 532
mbedAustin 11:cada08fc8a70 533 // Generate a random octet string seed
mbedAustin 11:cada08fc8a70 534 //
mbedAustin 11:cada08fc8a70 535 if( ( ret = f_rng( p_rng, p, hlen ) ) != 0 )
mbedAustin 11:cada08fc8a70 536 return( MBEDTLS_ERR_RSA_RNG_FAILED + ret );
mbedAustin 11:cada08fc8a70 537
mbedAustin 11:cada08fc8a70 538 p += hlen;
mbedAustin 11:cada08fc8a70 539
mbedAustin 11:cada08fc8a70 540 // Construct DB
mbedAustin 11:cada08fc8a70 541 //
mbedAustin 11:cada08fc8a70 542 mbedtls_md( md_info, label, label_len, p );
mbedAustin 11:cada08fc8a70 543 p += hlen;
mbedAustin 11:cada08fc8a70 544 p += olen - 2 * hlen - 2 - ilen;
mbedAustin 11:cada08fc8a70 545 *p++ = 1;
mbedAustin 11:cada08fc8a70 546 memcpy( p, input, ilen );
mbedAustin 11:cada08fc8a70 547
mbedAustin 11:cada08fc8a70 548 mbedtls_md_init( &md_ctx );
mbedAustin 11:cada08fc8a70 549 mbedtls_md_setup( &md_ctx, md_info, 0 );
mbedAustin 11:cada08fc8a70 550
mbedAustin 11:cada08fc8a70 551 // maskedDB: Apply dbMask to DB
mbedAustin 11:cada08fc8a70 552 //
mbedAustin 11:cada08fc8a70 553 mgf_mask( output + hlen + 1, olen - hlen - 1, output + 1, hlen,
mbedAustin 11:cada08fc8a70 554 &md_ctx );
mbedAustin 11:cada08fc8a70 555
mbedAustin 11:cada08fc8a70 556 // maskedSeed: Apply seedMask to seed
mbedAustin 11:cada08fc8a70 557 //
mbedAustin 11:cada08fc8a70 558 mgf_mask( output + 1, hlen, output + hlen + 1, olen - hlen - 1,
mbedAustin 11:cada08fc8a70 559 &md_ctx );
mbedAustin 11:cada08fc8a70 560
mbedAustin 11:cada08fc8a70 561 mbedtls_md_free( &md_ctx );
mbedAustin 11:cada08fc8a70 562
mbedAustin 11:cada08fc8a70 563 return( ( mode == MBEDTLS_RSA_PUBLIC )
mbedAustin 11:cada08fc8a70 564 ? mbedtls_rsa_public( ctx, output, output )
mbedAustin 11:cada08fc8a70 565 : mbedtls_rsa_private( ctx, f_rng, p_rng, output, output ) );
mbedAustin 11:cada08fc8a70 566 }
mbedAustin 11:cada08fc8a70 567 #endif /* MBEDTLS_PKCS1_V21 */
mbedAustin 11:cada08fc8a70 568
mbedAustin 11:cada08fc8a70 569 #if defined(MBEDTLS_PKCS1_V15)
mbedAustin 11:cada08fc8a70 570 /*
mbedAustin 11:cada08fc8a70 571 * Implementation of the PKCS#1 v2.1 RSAES-PKCS1-V1_5-ENCRYPT function
mbedAustin 11:cada08fc8a70 572 */
mbedAustin 11:cada08fc8a70 573 int mbedtls_rsa_rsaes_pkcs1_v15_encrypt( mbedtls_rsa_context *ctx,
mbedAustin 11:cada08fc8a70 574 int (*f_rng)(void *, unsigned char *, size_t),
mbedAustin 11:cada08fc8a70 575 void *p_rng,
mbedAustin 11:cada08fc8a70 576 int mode, size_t ilen,
mbedAustin 11:cada08fc8a70 577 const unsigned char *input,
mbedAustin 11:cada08fc8a70 578 unsigned char *output )
mbedAustin 11:cada08fc8a70 579 {
mbedAustin 11:cada08fc8a70 580 size_t nb_pad, olen;
mbedAustin 11:cada08fc8a70 581 int ret;
mbedAustin 11:cada08fc8a70 582 unsigned char *p = output;
mbedAustin 11:cada08fc8a70 583
mbedAustin 11:cada08fc8a70 584 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
mbedAustin 11:cada08fc8a70 585 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 586
mbedAustin 11:cada08fc8a70 587 if( f_rng == NULL )
mbedAustin 11:cada08fc8a70 588 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 589
mbedAustin 11:cada08fc8a70 590 olen = ctx->len;
mbedAustin 11:cada08fc8a70 591
mbedAustin 11:cada08fc8a70 592 if( olen < ilen + 11 )
mbedAustin 11:cada08fc8a70 593 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 594
mbedAustin 11:cada08fc8a70 595 nb_pad = olen - 3 - ilen;
mbedAustin 11:cada08fc8a70 596
mbedAustin 11:cada08fc8a70 597 *p++ = 0;
mbedAustin 11:cada08fc8a70 598 if( mode == MBEDTLS_RSA_PUBLIC )
mbedAustin 11:cada08fc8a70 599 {
mbedAustin 11:cada08fc8a70 600 *p++ = MBEDTLS_RSA_CRYPT;
mbedAustin 11:cada08fc8a70 601
mbedAustin 11:cada08fc8a70 602 while( nb_pad-- > 0 )
mbedAustin 11:cada08fc8a70 603 {
mbedAustin 11:cada08fc8a70 604 int rng_dl = 100;
mbedAustin 11:cada08fc8a70 605
mbedAustin 11:cada08fc8a70 606 do {
mbedAustin 11:cada08fc8a70 607 ret = f_rng( p_rng, p, 1 );
mbedAustin 11:cada08fc8a70 608 } while( *p == 0 && --rng_dl && ret == 0 );
mbedAustin 11:cada08fc8a70 609
mbedAustin 11:cada08fc8a70 610 // Check if RNG failed to generate data
mbedAustin 11:cada08fc8a70 611 //
mbedAustin 11:cada08fc8a70 612 if( rng_dl == 0 || ret != 0 )
mbedAustin 11:cada08fc8a70 613 return( MBEDTLS_ERR_RSA_RNG_FAILED + ret );
mbedAustin 11:cada08fc8a70 614
mbedAustin 11:cada08fc8a70 615 p++;
mbedAustin 11:cada08fc8a70 616 }
mbedAustin 11:cada08fc8a70 617 }
mbedAustin 11:cada08fc8a70 618 else
mbedAustin 11:cada08fc8a70 619 {
mbedAustin 11:cada08fc8a70 620 *p++ = MBEDTLS_RSA_SIGN;
mbedAustin 11:cada08fc8a70 621
mbedAustin 11:cada08fc8a70 622 while( nb_pad-- > 0 )
mbedAustin 11:cada08fc8a70 623 *p++ = 0xFF;
mbedAustin 11:cada08fc8a70 624 }
mbedAustin 11:cada08fc8a70 625
mbedAustin 11:cada08fc8a70 626 *p++ = 0;
mbedAustin 11:cada08fc8a70 627 memcpy( p, input, ilen );
mbedAustin 11:cada08fc8a70 628
mbedAustin 11:cada08fc8a70 629 return( ( mode == MBEDTLS_RSA_PUBLIC )
mbedAustin 11:cada08fc8a70 630 ? mbedtls_rsa_public( ctx, output, output )
mbedAustin 11:cada08fc8a70 631 : mbedtls_rsa_private( ctx, f_rng, p_rng, output, output ) );
mbedAustin 11:cada08fc8a70 632 }
mbedAustin 11:cada08fc8a70 633 #endif /* MBEDTLS_PKCS1_V15 */
mbedAustin 11:cada08fc8a70 634
mbedAustin 11:cada08fc8a70 635 /*
mbedAustin 11:cada08fc8a70 636 * Add the message padding, then do an RSA operation
mbedAustin 11:cada08fc8a70 637 */
mbedAustin 11:cada08fc8a70 638 int mbedtls_rsa_pkcs1_encrypt( mbedtls_rsa_context *ctx,
mbedAustin 11:cada08fc8a70 639 int (*f_rng)(void *, unsigned char *, size_t),
mbedAustin 11:cada08fc8a70 640 void *p_rng,
mbedAustin 11:cada08fc8a70 641 int mode, size_t ilen,
mbedAustin 11:cada08fc8a70 642 const unsigned char *input,
mbedAustin 11:cada08fc8a70 643 unsigned char *output )
mbedAustin 11:cada08fc8a70 644 {
mbedAustin 11:cada08fc8a70 645 switch( ctx->padding )
mbedAustin 11:cada08fc8a70 646 {
mbedAustin 11:cada08fc8a70 647 #if defined(MBEDTLS_PKCS1_V15)
mbedAustin 11:cada08fc8a70 648 case MBEDTLS_RSA_PKCS_V15:
mbedAustin 11:cada08fc8a70 649 return mbedtls_rsa_rsaes_pkcs1_v15_encrypt( ctx, f_rng, p_rng, mode, ilen,
mbedAustin 11:cada08fc8a70 650 input, output );
mbedAustin 11:cada08fc8a70 651 #endif
mbedAustin 11:cada08fc8a70 652
mbedAustin 11:cada08fc8a70 653 #if defined(MBEDTLS_PKCS1_V21)
mbedAustin 11:cada08fc8a70 654 case MBEDTLS_RSA_PKCS_V21:
mbedAustin 11:cada08fc8a70 655 return mbedtls_rsa_rsaes_oaep_encrypt( ctx, f_rng, p_rng, mode, NULL, 0,
mbedAustin 11:cada08fc8a70 656 ilen, input, output );
mbedAustin 11:cada08fc8a70 657 #endif
mbedAustin 11:cada08fc8a70 658
mbedAustin 11:cada08fc8a70 659 default:
mbedAustin 11:cada08fc8a70 660 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
mbedAustin 11:cada08fc8a70 661 }
mbedAustin 11:cada08fc8a70 662 }
mbedAustin 11:cada08fc8a70 663
mbedAustin 11:cada08fc8a70 664 #if defined(MBEDTLS_PKCS1_V21)
mbedAustin 11:cada08fc8a70 665 /*
mbedAustin 11:cada08fc8a70 666 * Implementation of the PKCS#1 v2.1 RSAES-OAEP-DECRYPT function
mbedAustin 11:cada08fc8a70 667 */
mbedAustin 11:cada08fc8a70 668 int mbedtls_rsa_rsaes_oaep_decrypt( mbedtls_rsa_context *ctx,
mbedAustin 11:cada08fc8a70 669 int (*f_rng)(void *, unsigned char *, size_t),
mbedAustin 11:cada08fc8a70 670 void *p_rng,
mbedAustin 11:cada08fc8a70 671 int mode,
mbedAustin 11:cada08fc8a70 672 const unsigned char *label, size_t label_len,
mbedAustin 11:cada08fc8a70 673 size_t *olen,
mbedAustin 11:cada08fc8a70 674 const unsigned char *input,
mbedAustin 11:cada08fc8a70 675 unsigned char *output,
mbedAustin 11:cada08fc8a70 676 size_t output_max_len )
mbedAustin 11:cada08fc8a70 677 {
mbedAustin 11:cada08fc8a70 678 int ret;
mbedAustin 11:cada08fc8a70 679 size_t ilen, i, pad_len;
mbedAustin 11:cada08fc8a70 680 unsigned char *p, bad, pad_done;
mbedAustin 11:cada08fc8a70 681 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
mbedAustin 11:cada08fc8a70 682 unsigned char lhash[MBEDTLS_MD_MAX_SIZE];
mbedAustin 11:cada08fc8a70 683 unsigned int hlen;
mbedAustin 11:cada08fc8a70 684 const mbedtls_md_info_t *md_info;
mbedAustin 11:cada08fc8a70 685 mbedtls_md_context_t md_ctx;
mbedAustin 11:cada08fc8a70 686
mbedAustin 11:cada08fc8a70 687 /*
mbedAustin 11:cada08fc8a70 688 * Parameters sanity checks
mbedAustin 11:cada08fc8a70 689 */
mbedAustin 11:cada08fc8a70 690 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
mbedAustin 11:cada08fc8a70 691 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 692
mbedAustin 11:cada08fc8a70 693 ilen = ctx->len;
mbedAustin 11:cada08fc8a70 694
mbedAustin 11:cada08fc8a70 695 if( ilen < 16 || ilen > sizeof( buf ) )
mbedAustin 11:cada08fc8a70 696 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 697
mbedAustin 11:cada08fc8a70 698 md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
mbedAustin 11:cada08fc8a70 699 if( md_info == NULL )
mbedAustin 11:cada08fc8a70 700 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 701
mbedAustin 11:cada08fc8a70 702 /*
mbedAustin 11:cada08fc8a70 703 * RSA operation
mbedAustin 11:cada08fc8a70 704 */
mbedAustin 11:cada08fc8a70 705 ret = ( mode == MBEDTLS_RSA_PUBLIC )
mbedAustin 11:cada08fc8a70 706 ? mbedtls_rsa_public( ctx, input, buf )
mbedAustin 11:cada08fc8a70 707 : mbedtls_rsa_private( ctx, f_rng, p_rng, input, buf );
mbedAustin 11:cada08fc8a70 708
mbedAustin 11:cada08fc8a70 709 if( ret != 0 )
mbedAustin 11:cada08fc8a70 710 return( ret );
mbedAustin 11:cada08fc8a70 711
mbedAustin 11:cada08fc8a70 712 /*
mbedAustin 11:cada08fc8a70 713 * Unmask data and generate lHash
mbedAustin 11:cada08fc8a70 714 */
mbedAustin 11:cada08fc8a70 715 hlen = mbedtls_md_get_size( md_info );
mbedAustin 11:cada08fc8a70 716
mbedAustin 11:cada08fc8a70 717 mbedtls_md_init( &md_ctx );
mbedAustin 11:cada08fc8a70 718 mbedtls_md_setup( &md_ctx, md_info, 0 );
mbedAustin 11:cada08fc8a70 719
mbedAustin 11:cada08fc8a70 720 /* Generate lHash */
mbedAustin 11:cada08fc8a70 721 mbedtls_md( md_info, label, label_len, lhash );
mbedAustin 11:cada08fc8a70 722
mbedAustin 11:cada08fc8a70 723 /* seed: Apply seedMask to maskedSeed */
mbedAustin 11:cada08fc8a70 724 mgf_mask( buf + 1, hlen, buf + hlen + 1, ilen - hlen - 1,
mbedAustin 11:cada08fc8a70 725 &md_ctx );
mbedAustin 11:cada08fc8a70 726
mbedAustin 11:cada08fc8a70 727 /* DB: Apply dbMask to maskedDB */
mbedAustin 11:cada08fc8a70 728 mgf_mask( buf + hlen + 1, ilen - hlen - 1, buf + 1, hlen,
mbedAustin 11:cada08fc8a70 729 &md_ctx );
mbedAustin 11:cada08fc8a70 730
mbedAustin 11:cada08fc8a70 731 mbedtls_md_free( &md_ctx );
mbedAustin 11:cada08fc8a70 732
mbedAustin 11:cada08fc8a70 733 /*
mbedAustin 11:cada08fc8a70 734 * Check contents, in "constant-time"
mbedAustin 11:cada08fc8a70 735 */
mbedAustin 11:cada08fc8a70 736 p = buf;
mbedAustin 11:cada08fc8a70 737 bad = 0;
mbedAustin 11:cada08fc8a70 738
mbedAustin 11:cada08fc8a70 739 bad |= *p++; /* First byte must be 0 */
mbedAustin 11:cada08fc8a70 740
mbedAustin 11:cada08fc8a70 741 p += hlen; /* Skip seed */
mbedAustin 11:cada08fc8a70 742
mbedAustin 11:cada08fc8a70 743 /* Check lHash */
mbedAustin 11:cada08fc8a70 744 for( i = 0; i < hlen; i++ )
mbedAustin 11:cada08fc8a70 745 bad |= lhash[i] ^ *p++;
mbedAustin 11:cada08fc8a70 746
mbedAustin 11:cada08fc8a70 747 /* Get zero-padding len, but always read till end of buffer
mbedAustin 11:cada08fc8a70 748 * (minus one, for the 01 byte) */
mbedAustin 11:cada08fc8a70 749 pad_len = 0;
mbedAustin 11:cada08fc8a70 750 pad_done = 0;
mbedAustin 11:cada08fc8a70 751 for( i = 0; i < ilen - 2 * hlen - 2; i++ )
mbedAustin 11:cada08fc8a70 752 {
mbedAustin 11:cada08fc8a70 753 pad_done |= p[i];
mbedAustin 11:cada08fc8a70 754 pad_len += ((pad_done | (unsigned char)-pad_done) >> 7) ^ 1;
mbedAustin 11:cada08fc8a70 755 }
mbedAustin 11:cada08fc8a70 756
mbedAustin 11:cada08fc8a70 757 p += pad_len;
mbedAustin 11:cada08fc8a70 758 bad |= *p++ ^ 0x01;
mbedAustin 11:cada08fc8a70 759
mbedAustin 11:cada08fc8a70 760 /*
mbedAustin 11:cada08fc8a70 761 * The only information "leaked" is whether the padding was correct or not
mbedAustin 11:cada08fc8a70 762 * (eg, no data is copied if it was not correct). This meets the
mbedAustin 11:cada08fc8a70 763 * recommendations in PKCS#1 v2.2: an opponent cannot distinguish between
mbedAustin 11:cada08fc8a70 764 * the different error conditions.
mbedAustin 11:cada08fc8a70 765 */
mbedAustin 11:cada08fc8a70 766 if( bad != 0 )
mbedAustin 11:cada08fc8a70 767 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
mbedAustin 11:cada08fc8a70 768
mbedAustin 11:cada08fc8a70 769 if( ilen - ( p - buf ) > output_max_len )
mbedAustin 11:cada08fc8a70 770 return( MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE );
mbedAustin 11:cada08fc8a70 771
mbedAustin 11:cada08fc8a70 772 *olen = ilen - (p - buf);
mbedAustin 11:cada08fc8a70 773 memcpy( output, p, *olen );
mbedAustin 11:cada08fc8a70 774
mbedAustin 11:cada08fc8a70 775 return( 0 );
mbedAustin 11:cada08fc8a70 776 }
mbedAustin 11:cada08fc8a70 777 #endif /* MBEDTLS_PKCS1_V21 */
mbedAustin 11:cada08fc8a70 778
mbedAustin 11:cada08fc8a70 779 #if defined(MBEDTLS_PKCS1_V15)
mbedAustin 11:cada08fc8a70 780 /*
mbedAustin 11:cada08fc8a70 781 * Implementation of the PKCS#1 v2.1 RSAES-PKCS1-V1_5-DECRYPT function
mbedAustin 11:cada08fc8a70 782 */
mbedAustin 11:cada08fc8a70 783 int mbedtls_rsa_rsaes_pkcs1_v15_decrypt( mbedtls_rsa_context *ctx,
mbedAustin 11:cada08fc8a70 784 int (*f_rng)(void *, unsigned char *, size_t),
mbedAustin 11:cada08fc8a70 785 void *p_rng,
mbedAustin 11:cada08fc8a70 786 int mode, size_t *olen,
mbedAustin 11:cada08fc8a70 787 const unsigned char *input,
mbedAustin 11:cada08fc8a70 788 unsigned char *output,
mbedAustin 11:cada08fc8a70 789 size_t output_max_len)
mbedAustin 11:cada08fc8a70 790 {
mbedAustin 11:cada08fc8a70 791 int ret;
mbedAustin 11:cada08fc8a70 792 size_t ilen, pad_count = 0, i;
mbedAustin 11:cada08fc8a70 793 unsigned char *p, bad, pad_done = 0;
mbedAustin 11:cada08fc8a70 794 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
mbedAustin 11:cada08fc8a70 795
mbedAustin 11:cada08fc8a70 796 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
mbedAustin 11:cada08fc8a70 797 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 798
mbedAustin 11:cada08fc8a70 799 ilen = ctx->len;
mbedAustin 11:cada08fc8a70 800
mbedAustin 11:cada08fc8a70 801 if( ilen < 16 || ilen > sizeof( buf ) )
mbedAustin 11:cada08fc8a70 802 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 803
mbedAustin 11:cada08fc8a70 804 ret = ( mode == MBEDTLS_RSA_PUBLIC )
mbedAustin 11:cada08fc8a70 805 ? mbedtls_rsa_public( ctx, input, buf )
mbedAustin 11:cada08fc8a70 806 : mbedtls_rsa_private( ctx, f_rng, p_rng, input, buf );
mbedAustin 11:cada08fc8a70 807
mbedAustin 11:cada08fc8a70 808 if( ret != 0 )
mbedAustin 11:cada08fc8a70 809 return( ret );
mbedAustin 11:cada08fc8a70 810
mbedAustin 11:cada08fc8a70 811 p = buf;
mbedAustin 11:cada08fc8a70 812 bad = 0;
mbedAustin 11:cada08fc8a70 813
mbedAustin 11:cada08fc8a70 814 /*
mbedAustin 11:cada08fc8a70 815 * Check and get padding len in "constant-time"
mbedAustin 11:cada08fc8a70 816 */
mbedAustin 11:cada08fc8a70 817 bad |= *p++; /* First byte must be 0 */
mbedAustin 11:cada08fc8a70 818
mbedAustin 11:cada08fc8a70 819 /* This test does not depend on secret data */
mbedAustin 11:cada08fc8a70 820 if( mode == MBEDTLS_RSA_PRIVATE )
mbedAustin 11:cada08fc8a70 821 {
mbedAustin 11:cada08fc8a70 822 bad |= *p++ ^ MBEDTLS_RSA_CRYPT;
mbedAustin 11:cada08fc8a70 823
mbedAustin 11:cada08fc8a70 824 /* Get padding len, but always read till end of buffer
mbedAustin 11:cada08fc8a70 825 * (minus one, for the 00 byte) */
mbedAustin 11:cada08fc8a70 826 for( i = 0; i < ilen - 3; i++ )
mbedAustin 11:cada08fc8a70 827 {
mbedAustin 11:cada08fc8a70 828 pad_done |= ((p[i] | (unsigned char)-p[i]) >> 7) ^ 1;
mbedAustin 11:cada08fc8a70 829 pad_count += ((pad_done | (unsigned char)-pad_done) >> 7) ^ 1;
mbedAustin 11:cada08fc8a70 830 }
mbedAustin 11:cada08fc8a70 831
mbedAustin 11:cada08fc8a70 832 p += pad_count;
mbedAustin 11:cada08fc8a70 833 bad |= *p++; /* Must be zero */
mbedAustin 11:cada08fc8a70 834 }
mbedAustin 11:cada08fc8a70 835 else
mbedAustin 11:cada08fc8a70 836 {
mbedAustin 11:cada08fc8a70 837 bad |= *p++ ^ MBEDTLS_RSA_SIGN;
mbedAustin 11:cada08fc8a70 838
mbedAustin 11:cada08fc8a70 839 /* Get padding len, but always read till end of buffer
mbedAustin 11:cada08fc8a70 840 * (minus one, for the 00 byte) */
mbedAustin 11:cada08fc8a70 841 for( i = 0; i < ilen - 3; i++ )
mbedAustin 11:cada08fc8a70 842 {
mbedAustin 11:cada08fc8a70 843 pad_done |= ( p[i] != 0xFF );
mbedAustin 11:cada08fc8a70 844 pad_count += ( pad_done == 0 );
mbedAustin 11:cada08fc8a70 845 }
mbedAustin 11:cada08fc8a70 846
mbedAustin 11:cada08fc8a70 847 p += pad_count;
mbedAustin 11:cada08fc8a70 848 bad |= *p++; /* Must be zero */
mbedAustin 11:cada08fc8a70 849 }
mbedAustin 11:cada08fc8a70 850
mbedAustin 11:cada08fc8a70 851 if( bad )
mbedAustin 11:cada08fc8a70 852 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
mbedAustin 11:cada08fc8a70 853
mbedAustin 11:cada08fc8a70 854 if( ilen - ( p - buf ) > output_max_len )
mbedAustin 11:cada08fc8a70 855 return( MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE );
mbedAustin 11:cada08fc8a70 856
mbedAustin 11:cada08fc8a70 857 *olen = ilen - (p - buf);
mbedAustin 11:cada08fc8a70 858 memcpy( output, p, *olen );
mbedAustin 11:cada08fc8a70 859
mbedAustin 11:cada08fc8a70 860 return( 0 );
mbedAustin 11:cada08fc8a70 861 }
mbedAustin 11:cada08fc8a70 862 #endif /* MBEDTLS_PKCS1_V15 */
mbedAustin 11:cada08fc8a70 863
mbedAustin 11:cada08fc8a70 864 /*
mbedAustin 11:cada08fc8a70 865 * Do an RSA operation, then remove the message padding
mbedAustin 11:cada08fc8a70 866 */
mbedAustin 11:cada08fc8a70 867 int mbedtls_rsa_pkcs1_decrypt( mbedtls_rsa_context *ctx,
mbedAustin 11:cada08fc8a70 868 int (*f_rng)(void *, unsigned char *, size_t),
mbedAustin 11:cada08fc8a70 869 void *p_rng,
mbedAustin 11:cada08fc8a70 870 int mode, size_t *olen,
mbedAustin 11:cada08fc8a70 871 const unsigned char *input,
mbedAustin 11:cada08fc8a70 872 unsigned char *output,
mbedAustin 11:cada08fc8a70 873 size_t output_max_len)
mbedAustin 11:cada08fc8a70 874 {
mbedAustin 11:cada08fc8a70 875 switch( ctx->padding )
mbedAustin 11:cada08fc8a70 876 {
mbedAustin 11:cada08fc8a70 877 #if defined(MBEDTLS_PKCS1_V15)
mbedAustin 11:cada08fc8a70 878 case MBEDTLS_RSA_PKCS_V15:
mbedAustin 11:cada08fc8a70 879 return mbedtls_rsa_rsaes_pkcs1_v15_decrypt( ctx, f_rng, p_rng, mode, olen,
mbedAustin 11:cada08fc8a70 880 input, output, output_max_len );
mbedAustin 11:cada08fc8a70 881 #endif
mbedAustin 11:cada08fc8a70 882
mbedAustin 11:cada08fc8a70 883 #if defined(MBEDTLS_PKCS1_V21)
mbedAustin 11:cada08fc8a70 884 case MBEDTLS_RSA_PKCS_V21:
mbedAustin 11:cada08fc8a70 885 return mbedtls_rsa_rsaes_oaep_decrypt( ctx, f_rng, p_rng, mode, NULL, 0,
mbedAustin 11:cada08fc8a70 886 olen, input, output,
mbedAustin 11:cada08fc8a70 887 output_max_len );
mbedAustin 11:cada08fc8a70 888 #endif
mbedAustin 11:cada08fc8a70 889
mbedAustin 11:cada08fc8a70 890 default:
mbedAustin 11:cada08fc8a70 891 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
mbedAustin 11:cada08fc8a70 892 }
mbedAustin 11:cada08fc8a70 893 }
mbedAustin 11:cada08fc8a70 894
mbedAustin 11:cada08fc8a70 895 #if defined(MBEDTLS_PKCS1_V21)
mbedAustin 11:cada08fc8a70 896 /*
mbedAustin 11:cada08fc8a70 897 * Implementation of the PKCS#1 v2.1 RSASSA-PSS-SIGN function
mbedAustin 11:cada08fc8a70 898 */
mbedAustin 11:cada08fc8a70 899 int mbedtls_rsa_rsassa_pss_sign( mbedtls_rsa_context *ctx,
mbedAustin 11:cada08fc8a70 900 int (*f_rng)(void *, unsigned char *, size_t),
mbedAustin 11:cada08fc8a70 901 void *p_rng,
mbedAustin 11:cada08fc8a70 902 int mode,
mbedAustin 11:cada08fc8a70 903 mbedtls_md_type_t md_alg,
mbedAustin 11:cada08fc8a70 904 unsigned int hashlen,
mbedAustin 11:cada08fc8a70 905 const unsigned char *hash,
mbedAustin 11:cada08fc8a70 906 unsigned char *sig )
mbedAustin 11:cada08fc8a70 907 {
mbedAustin 11:cada08fc8a70 908 size_t olen;
mbedAustin 11:cada08fc8a70 909 unsigned char *p = sig;
mbedAustin 11:cada08fc8a70 910 unsigned char salt[MBEDTLS_MD_MAX_SIZE];
mbedAustin 11:cada08fc8a70 911 unsigned int slen, hlen, offset = 0;
mbedAustin 11:cada08fc8a70 912 int ret;
mbedAustin 11:cada08fc8a70 913 size_t msb;
mbedAustin 11:cada08fc8a70 914 const mbedtls_md_info_t *md_info;
mbedAustin 11:cada08fc8a70 915 mbedtls_md_context_t md_ctx;
mbedAustin 11:cada08fc8a70 916
mbedAustin 11:cada08fc8a70 917 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
mbedAustin 11:cada08fc8a70 918 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 919
mbedAustin 11:cada08fc8a70 920 if( f_rng == NULL )
mbedAustin 11:cada08fc8a70 921 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 922
mbedAustin 11:cada08fc8a70 923 olen = ctx->len;
mbedAustin 11:cada08fc8a70 924
mbedAustin 11:cada08fc8a70 925 if( md_alg != MBEDTLS_MD_NONE )
mbedAustin 11:cada08fc8a70 926 {
mbedAustin 11:cada08fc8a70 927 // Gather length of hash to sign
mbedAustin 11:cada08fc8a70 928 //
mbedAustin 11:cada08fc8a70 929 md_info = mbedtls_md_info_from_type( md_alg );
mbedAustin 11:cada08fc8a70 930 if( md_info == NULL )
mbedAustin 11:cada08fc8a70 931 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 932
mbedAustin 11:cada08fc8a70 933 hashlen = mbedtls_md_get_size( md_info );
mbedAustin 11:cada08fc8a70 934 }
mbedAustin 11:cada08fc8a70 935
mbedAustin 11:cada08fc8a70 936 md_info = mbedtls_md_info_from_type( (mbedtls_md_type_t) ctx->hash_id );
mbedAustin 11:cada08fc8a70 937 if( md_info == NULL )
mbedAustin 11:cada08fc8a70 938 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 939
mbedAustin 11:cada08fc8a70 940 hlen = mbedtls_md_get_size( md_info );
mbedAustin 11:cada08fc8a70 941 slen = hlen;
mbedAustin 11:cada08fc8a70 942
mbedAustin 11:cada08fc8a70 943 if( olen < hlen + slen + 2 )
mbedAustin 11:cada08fc8a70 944 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 945
mbedAustin 11:cada08fc8a70 946 memset( sig, 0, olen );
mbedAustin 11:cada08fc8a70 947
mbedAustin 11:cada08fc8a70 948 // Generate salt of length slen
mbedAustin 11:cada08fc8a70 949 //
mbedAustin 11:cada08fc8a70 950 if( ( ret = f_rng( p_rng, salt, slen ) ) != 0 )
mbedAustin 11:cada08fc8a70 951 return( MBEDTLS_ERR_RSA_RNG_FAILED + ret );
mbedAustin 11:cada08fc8a70 952
mbedAustin 11:cada08fc8a70 953 // Note: EMSA-PSS encoding is over the length of N - 1 bits
mbedAustin 11:cada08fc8a70 954 //
mbedAustin 11:cada08fc8a70 955 msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
mbedAustin 11:cada08fc8a70 956 p += olen - hlen * 2 - 2;
mbedAustin 11:cada08fc8a70 957 *p++ = 0x01;
mbedAustin 11:cada08fc8a70 958 memcpy( p, salt, slen );
mbedAustin 11:cada08fc8a70 959 p += slen;
mbedAustin 11:cada08fc8a70 960
mbedAustin 11:cada08fc8a70 961 mbedtls_md_init( &md_ctx );
mbedAustin 11:cada08fc8a70 962 mbedtls_md_setup( &md_ctx, md_info, 0 );
mbedAustin 11:cada08fc8a70 963
mbedAustin 11:cada08fc8a70 964 // Generate H = Hash( M' )
mbedAustin 11:cada08fc8a70 965 //
mbedAustin 11:cada08fc8a70 966 mbedtls_md_starts( &md_ctx );
mbedAustin 11:cada08fc8a70 967 mbedtls_md_update( &md_ctx, p, 8 );
mbedAustin 11:cada08fc8a70 968 mbedtls_md_update( &md_ctx, hash, hashlen );
mbedAustin 11:cada08fc8a70 969 mbedtls_md_update( &md_ctx, salt, slen );
mbedAustin 11:cada08fc8a70 970 mbedtls_md_finish( &md_ctx, p );
mbedAustin 11:cada08fc8a70 971
mbedAustin 11:cada08fc8a70 972 // Compensate for boundary condition when applying mask
mbedAustin 11:cada08fc8a70 973 //
mbedAustin 11:cada08fc8a70 974 if( msb % 8 == 0 )
mbedAustin 11:cada08fc8a70 975 offset = 1;
mbedAustin 11:cada08fc8a70 976
mbedAustin 11:cada08fc8a70 977 // maskedDB: Apply dbMask to DB
mbedAustin 11:cada08fc8a70 978 //
mbedAustin 11:cada08fc8a70 979 mgf_mask( sig + offset, olen - hlen - 1 - offset, p, hlen, &md_ctx );
mbedAustin 11:cada08fc8a70 980
mbedAustin 11:cada08fc8a70 981 mbedtls_md_free( &md_ctx );
mbedAustin 11:cada08fc8a70 982
mbedAustin 11:cada08fc8a70 983 msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
mbedAustin 11:cada08fc8a70 984 sig[0] &= 0xFF >> ( olen * 8 - msb );
mbedAustin 11:cada08fc8a70 985
mbedAustin 11:cada08fc8a70 986 p += hlen;
mbedAustin 11:cada08fc8a70 987 *p++ = 0xBC;
mbedAustin 11:cada08fc8a70 988
mbedAustin 11:cada08fc8a70 989 return( ( mode == MBEDTLS_RSA_PUBLIC )
mbedAustin 11:cada08fc8a70 990 ? mbedtls_rsa_public( ctx, sig, sig )
mbedAustin 11:cada08fc8a70 991 : mbedtls_rsa_private( ctx, f_rng, p_rng, sig, sig ) );
mbedAustin 11:cada08fc8a70 992 }
mbedAustin 11:cada08fc8a70 993 #endif /* MBEDTLS_PKCS1_V21 */
mbedAustin 11:cada08fc8a70 994
mbedAustin 11:cada08fc8a70 995 #if defined(MBEDTLS_PKCS1_V15)
mbedAustin 11:cada08fc8a70 996 /*
mbedAustin 11:cada08fc8a70 997 * Implementation of the PKCS#1 v2.1 RSASSA-PKCS1-V1_5-SIGN function
mbedAustin 11:cada08fc8a70 998 */
mbedAustin 11:cada08fc8a70 999 /*
mbedAustin 11:cada08fc8a70 1000 * Do an RSA operation to sign the message digest
mbedAustin 11:cada08fc8a70 1001 */
mbedAustin 11:cada08fc8a70 1002 int mbedtls_rsa_rsassa_pkcs1_v15_sign( mbedtls_rsa_context *ctx,
mbedAustin 11:cada08fc8a70 1003 int (*f_rng)(void *, unsigned char *, size_t),
mbedAustin 11:cada08fc8a70 1004 void *p_rng,
mbedAustin 11:cada08fc8a70 1005 int mode,
mbedAustin 11:cada08fc8a70 1006 mbedtls_md_type_t md_alg,
mbedAustin 11:cada08fc8a70 1007 unsigned int hashlen,
mbedAustin 11:cada08fc8a70 1008 const unsigned char *hash,
mbedAustin 11:cada08fc8a70 1009 unsigned char *sig )
mbedAustin 11:cada08fc8a70 1010 {
mbedAustin 11:cada08fc8a70 1011 size_t nb_pad, olen, oid_size = 0;
mbedAustin 11:cada08fc8a70 1012 unsigned char *p = sig;
mbedAustin 11:cada08fc8a70 1013 const char *oid = NULL;
mbedAustin 11:cada08fc8a70 1014 unsigned char *sig_try = NULL, *verif = NULL;
mbedAustin 11:cada08fc8a70 1015 size_t i;
mbedAustin 11:cada08fc8a70 1016 unsigned char diff;
mbedAustin 11:cada08fc8a70 1017 volatile unsigned char diff_no_optimize;
mbedAustin 11:cada08fc8a70 1018 int ret;
mbedAustin 11:cada08fc8a70 1019
mbedAustin 11:cada08fc8a70 1020 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
mbedAustin 11:cada08fc8a70 1021 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 1022
mbedAustin 11:cada08fc8a70 1023 olen = ctx->len;
mbedAustin 11:cada08fc8a70 1024 nb_pad = olen - 3;
mbedAustin 11:cada08fc8a70 1025
mbedAustin 11:cada08fc8a70 1026 if( md_alg != MBEDTLS_MD_NONE )
mbedAustin 11:cada08fc8a70 1027 {
mbedAustin 11:cada08fc8a70 1028 const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type( md_alg );
mbedAustin 11:cada08fc8a70 1029 if( md_info == NULL )
mbedAustin 11:cada08fc8a70 1030 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 1031
mbedAustin 11:cada08fc8a70 1032 if( mbedtls_oid_get_oid_by_md( md_alg, &oid, &oid_size ) != 0 )
mbedAustin 11:cada08fc8a70 1033 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 1034
mbedAustin 11:cada08fc8a70 1035 nb_pad -= 10 + oid_size;
mbedAustin 11:cada08fc8a70 1036
mbedAustin 11:cada08fc8a70 1037 hashlen = mbedtls_md_get_size( md_info );
mbedAustin 11:cada08fc8a70 1038 }
mbedAustin 11:cada08fc8a70 1039
mbedAustin 11:cada08fc8a70 1040 nb_pad -= hashlen;
mbedAustin 11:cada08fc8a70 1041
mbedAustin 11:cada08fc8a70 1042 if( ( nb_pad < 8 ) || ( nb_pad > olen ) )
mbedAustin 11:cada08fc8a70 1043 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 1044
mbedAustin 11:cada08fc8a70 1045 *p++ = 0;
mbedAustin 11:cada08fc8a70 1046 *p++ = MBEDTLS_RSA_SIGN;
mbedAustin 11:cada08fc8a70 1047 memset( p, 0xFF, nb_pad );
mbedAustin 11:cada08fc8a70 1048 p += nb_pad;
mbedAustin 11:cada08fc8a70 1049 *p++ = 0;
mbedAustin 11:cada08fc8a70 1050
mbedAustin 11:cada08fc8a70 1051 if( md_alg == MBEDTLS_MD_NONE )
mbedAustin 11:cada08fc8a70 1052 {
mbedAustin 11:cada08fc8a70 1053 memcpy( p, hash, hashlen );
mbedAustin 11:cada08fc8a70 1054 }
mbedAustin 11:cada08fc8a70 1055 else
mbedAustin 11:cada08fc8a70 1056 {
mbedAustin 11:cada08fc8a70 1057 /*
mbedAustin 11:cada08fc8a70 1058 * DigestInfo ::= SEQUENCE {
mbedAustin 11:cada08fc8a70 1059 * digestAlgorithm DigestAlgorithmIdentifier,
mbedAustin 11:cada08fc8a70 1060 * digest Digest }
mbedAustin 11:cada08fc8a70 1061 *
mbedAustin 11:cada08fc8a70 1062 * DigestAlgorithmIdentifier ::= AlgorithmIdentifier
mbedAustin 11:cada08fc8a70 1063 *
mbedAustin 11:cada08fc8a70 1064 * Digest ::= OCTET STRING
mbedAustin 11:cada08fc8a70 1065 */
mbedAustin 11:cada08fc8a70 1066 *p++ = MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED;
mbedAustin 11:cada08fc8a70 1067 *p++ = (unsigned char) ( 0x08 + oid_size + hashlen );
mbedAustin 11:cada08fc8a70 1068 *p++ = MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED;
mbedAustin 11:cada08fc8a70 1069 *p++ = (unsigned char) ( 0x04 + oid_size );
mbedAustin 11:cada08fc8a70 1070 *p++ = MBEDTLS_ASN1_OID;
mbedAustin 11:cada08fc8a70 1071 *p++ = oid_size & 0xFF;
mbedAustin 11:cada08fc8a70 1072 memcpy( p, oid, oid_size );
mbedAustin 11:cada08fc8a70 1073 p += oid_size;
mbedAustin 11:cada08fc8a70 1074 *p++ = MBEDTLS_ASN1_NULL;
mbedAustin 11:cada08fc8a70 1075 *p++ = 0x00;
mbedAustin 11:cada08fc8a70 1076 *p++ = MBEDTLS_ASN1_OCTET_STRING;
mbedAustin 11:cada08fc8a70 1077 *p++ = hashlen;
mbedAustin 11:cada08fc8a70 1078 memcpy( p, hash, hashlen );
mbedAustin 11:cada08fc8a70 1079 }
mbedAustin 11:cada08fc8a70 1080
mbedAustin 11:cada08fc8a70 1081 if( mode == MBEDTLS_RSA_PUBLIC )
mbedAustin 11:cada08fc8a70 1082 return( mbedtls_rsa_public( ctx, sig, sig ) );
mbedAustin 11:cada08fc8a70 1083
mbedAustin 11:cada08fc8a70 1084 /*
mbedAustin 11:cada08fc8a70 1085 * In order to prevent Lenstra's attack, make the signature in a
mbedAustin 11:cada08fc8a70 1086 * temporary buffer and check it before returning it.
mbedAustin 11:cada08fc8a70 1087 */
mbedAustin 11:cada08fc8a70 1088 sig_try = mbedtls_calloc( 1, ctx->len );
mbedAustin 11:cada08fc8a70 1089 verif = mbedtls_calloc( 1, ctx->len );
mbedAustin 11:cada08fc8a70 1090 if( sig_try == NULL || verif == NULL )
mbedAustin 11:cada08fc8a70 1091 return( MBEDTLS_ERR_MPI_ALLOC_FAILED );
mbedAustin 11:cada08fc8a70 1092
mbedAustin 11:cada08fc8a70 1093 MBEDTLS_MPI_CHK( mbedtls_rsa_private( ctx, f_rng, p_rng, sig, sig_try ) );
mbedAustin 11:cada08fc8a70 1094 MBEDTLS_MPI_CHK( mbedtls_rsa_public( ctx, sig_try, verif ) );
mbedAustin 11:cada08fc8a70 1095
mbedAustin 11:cada08fc8a70 1096 /* Compare in constant time just in case */
mbedAustin 11:cada08fc8a70 1097 for( diff = 0, i = 0; i < ctx->len; i++ )
mbedAustin 11:cada08fc8a70 1098 diff |= verif[i] ^ sig[i];
mbedAustin 11:cada08fc8a70 1099 diff_no_optimize = diff;
mbedAustin 11:cada08fc8a70 1100
mbedAustin 11:cada08fc8a70 1101 if( diff_no_optimize != 0 )
mbedAustin 11:cada08fc8a70 1102 {
mbedAustin 11:cada08fc8a70 1103 ret = MBEDTLS_ERR_RSA_PRIVATE_FAILED;
mbedAustin 11:cada08fc8a70 1104 goto cleanup;
mbedAustin 11:cada08fc8a70 1105 }
mbedAustin 11:cada08fc8a70 1106
mbedAustin 11:cada08fc8a70 1107 memcpy( sig, sig_try, ctx->len );
mbedAustin 11:cada08fc8a70 1108
mbedAustin 11:cada08fc8a70 1109 cleanup:
mbedAustin 11:cada08fc8a70 1110 mbedtls_free( sig_try );
mbedAustin 11:cada08fc8a70 1111 mbedtls_free( verif );
mbedAustin 11:cada08fc8a70 1112
mbedAustin 11:cada08fc8a70 1113 return( ret );
mbedAustin 11:cada08fc8a70 1114 }
mbedAustin 11:cada08fc8a70 1115 #endif /* MBEDTLS_PKCS1_V15 */
mbedAustin 11:cada08fc8a70 1116
mbedAustin 11:cada08fc8a70 1117 /*
mbedAustin 11:cada08fc8a70 1118 * Do an RSA operation to sign the message digest
mbedAustin 11:cada08fc8a70 1119 */
mbedAustin 11:cada08fc8a70 1120 int mbedtls_rsa_pkcs1_sign( mbedtls_rsa_context *ctx,
mbedAustin 11:cada08fc8a70 1121 int (*f_rng)(void *, unsigned char *, size_t),
mbedAustin 11:cada08fc8a70 1122 void *p_rng,
mbedAustin 11:cada08fc8a70 1123 int mode,
mbedAustin 11:cada08fc8a70 1124 mbedtls_md_type_t md_alg,
mbedAustin 11:cada08fc8a70 1125 unsigned int hashlen,
mbedAustin 11:cada08fc8a70 1126 const unsigned char *hash,
mbedAustin 11:cada08fc8a70 1127 unsigned char *sig )
mbedAustin 11:cada08fc8a70 1128 {
mbedAustin 11:cada08fc8a70 1129 switch( ctx->padding )
mbedAustin 11:cada08fc8a70 1130 {
mbedAustin 11:cada08fc8a70 1131 #if defined(MBEDTLS_PKCS1_V15)
mbedAustin 11:cada08fc8a70 1132 case MBEDTLS_RSA_PKCS_V15:
mbedAustin 11:cada08fc8a70 1133 return mbedtls_rsa_rsassa_pkcs1_v15_sign( ctx, f_rng, p_rng, mode, md_alg,
mbedAustin 11:cada08fc8a70 1134 hashlen, hash, sig );
mbedAustin 11:cada08fc8a70 1135 #endif
mbedAustin 11:cada08fc8a70 1136
mbedAustin 11:cada08fc8a70 1137 #if defined(MBEDTLS_PKCS1_V21)
mbedAustin 11:cada08fc8a70 1138 case MBEDTLS_RSA_PKCS_V21:
mbedAustin 11:cada08fc8a70 1139 return mbedtls_rsa_rsassa_pss_sign( ctx, f_rng, p_rng, mode, md_alg,
mbedAustin 11:cada08fc8a70 1140 hashlen, hash, sig );
mbedAustin 11:cada08fc8a70 1141 #endif
mbedAustin 11:cada08fc8a70 1142
mbedAustin 11:cada08fc8a70 1143 default:
mbedAustin 11:cada08fc8a70 1144 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
mbedAustin 11:cada08fc8a70 1145 }
mbedAustin 11:cada08fc8a70 1146 }
mbedAustin 11:cada08fc8a70 1147
mbedAustin 11:cada08fc8a70 1148 #if defined(MBEDTLS_PKCS1_V21)
mbedAustin 11:cada08fc8a70 1149 /*
mbedAustin 11:cada08fc8a70 1150 * Implementation of the PKCS#1 v2.1 RSASSA-PSS-VERIFY function
mbedAustin 11:cada08fc8a70 1151 */
mbedAustin 11:cada08fc8a70 1152 int mbedtls_rsa_rsassa_pss_verify_ext( mbedtls_rsa_context *ctx,
mbedAustin 11:cada08fc8a70 1153 int (*f_rng)(void *, unsigned char *, size_t),
mbedAustin 11:cada08fc8a70 1154 void *p_rng,
mbedAustin 11:cada08fc8a70 1155 int mode,
mbedAustin 11:cada08fc8a70 1156 mbedtls_md_type_t md_alg,
mbedAustin 11:cada08fc8a70 1157 unsigned int hashlen,
mbedAustin 11:cada08fc8a70 1158 const unsigned char *hash,
mbedAustin 11:cada08fc8a70 1159 mbedtls_md_type_t mgf1_hash_id,
mbedAustin 11:cada08fc8a70 1160 int expected_salt_len,
mbedAustin 11:cada08fc8a70 1161 const unsigned char *sig )
mbedAustin 11:cada08fc8a70 1162 {
mbedAustin 11:cada08fc8a70 1163 int ret;
mbedAustin 11:cada08fc8a70 1164 size_t siglen;
mbedAustin 11:cada08fc8a70 1165 unsigned char *p;
mbedAustin 11:cada08fc8a70 1166 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
mbedAustin 11:cada08fc8a70 1167 unsigned char result[MBEDTLS_MD_MAX_SIZE];
mbedAustin 11:cada08fc8a70 1168 unsigned char zeros[8];
mbedAustin 11:cada08fc8a70 1169 unsigned int hlen;
mbedAustin 11:cada08fc8a70 1170 size_t slen, msb;
mbedAustin 11:cada08fc8a70 1171 const mbedtls_md_info_t *md_info;
mbedAustin 11:cada08fc8a70 1172 mbedtls_md_context_t md_ctx;
mbedAustin 11:cada08fc8a70 1173
mbedAustin 11:cada08fc8a70 1174 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V21 )
mbedAustin 11:cada08fc8a70 1175 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 1176
mbedAustin 11:cada08fc8a70 1177 siglen = ctx->len;
mbedAustin 11:cada08fc8a70 1178
mbedAustin 11:cada08fc8a70 1179 if( siglen < 16 || siglen > sizeof( buf ) )
mbedAustin 11:cada08fc8a70 1180 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 1181
mbedAustin 11:cada08fc8a70 1182 ret = ( mode == MBEDTLS_RSA_PUBLIC )
mbedAustin 11:cada08fc8a70 1183 ? mbedtls_rsa_public( ctx, sig, buf )
mbedAustin 11:cada08fc8a70 1184 : mbedtls_rsa_private( ctx, f_rng, p_rng, sig, buf );
mbedAustin 11:cada08fc8a70 1185
mbedAustin 11:cada08fc8a70 1186 if( ret != 0 )
mbedAustin 11:cada08fc8a70 1187 return( ret );
mbedAustin 11:cada08fc8a70 1188
mbedAustin 11:cada08fc8a70 1189 p = buf;
mbedAustin 11:cada08fc8a70 1190
mbedAustin 11:cada08fc8a70 1191 if( buf[siglen - 1] != 0xBC )
mbedAustin 11:cada08fc8a70 1192 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
mbedAustin 11:cada08fc8a70 1193
mbedAustin 11:cada08fc8a70 1194 if( md_alg != MBEDTLS_MD_NONE )
mbedAustin 11:cada08fc8a70 1195 {
mbedAustin 11:cada08fc8a70 1196 // Gather length of hash to sign
mbedAustin 11:cada08fc8a70 1197 //
mbedAustin 11:cada08fc8a70 1198 md_info = mbedtls_md_info_from_type( md_alg );
mbedAustin 11:cada08fc8a70 1199 if( md_info == NULL )
mbedAustin 11:cada08fc8a70 1200 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 1201
mbedAustin 11:cada08fc8a70 1202 hashlen = mbedtls_md_get_size( md_info );
mbedAustin 11:cada08fc8a70 1203 }
mbedAustin 11:cada08fc8a70 1204
mbedAustin 11:cada08fc8a70 1205 md_info = mbedtls_md_info_from_type( mgf1_hash_id );
mbedAustin 11:cada08fc8a70 1206 if( md_info == NULL )
mbedAustin 11:cada08fc8a70 1207 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 1208
mbedAustin 11:cada08fc8a70 1209 hlen = mbedtls_md_get_size( md_info );
mbedAustin 11:cada08fc8a70 1210 slen = siglen - hlen - 1; /* Currently length of salt + padding */
mbedAustin 11:cada08fc8a70 1211
mbedAustin 11:cada08fc8a70 1212 memset( zeros, 0, 8 );
mbedAustin 11:cada08fc8a70 1213
mbedAustin 11:cada08fc8a70 1214 // Note: EMSA-PSS verification is over the length of N - 1 bits
mbedAustin 11:cada08fc8a70 1215 //
mbedAustin 11:cada08fc8a70 1216 msb = mbedtls_mpi_bitlen( &ctx->N ) - 1;
mbedAustin 11:cada08fc8a70 1217
mbedAustin 11:cada08fc8a70 1218 // Compensate for boundary condition when applying mask
mbedAustin 11:cada08fc8a70 1219 //
mbedAustin 11:cada08fc8a70 1220 if( msb % 8 == 0 )
mbedAustin 11:cada08fc8a70 1221 {
mbedAustin 11:cada08fc8a70 1222 p++;
mbedAustin 11:cada08fc8a70 1223 siglen -= 1;
mbedAustin 11:cada08fc8a70 1224 }
mbedAustin 11:cada08fc8a70 1225 if( buf[0] >> ( 8 - siglen * 8 + msb ) )
mbedAustin 11:cada08fc8a70 1226 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 1227
mbedAustin 11:cada08fc8a70 1228 mbedtls_md_init( &md_ctx );
mbedAustin 11:cada08fc8a70 1229 mbedtls_md_setup( &md_ctx, md_info, 0 );
mbedAustin 11:cada08fc8a70 1230
mbedAustin 11:cada08fc8a70 1231 mgf_mask( p, siglen - hlen - 1, p + siglen - hlen - 1, hlen, &md_ctx );
mbedAustin 11:cada08fc8a70 1232
mbedAustin 11:cada08fc8a70 1233 buf[0] &= 0xFF >> ( siglen * 8 - msb );
mbedAustin 11:cada08fc8a70 1234
mbedAustin 11:cada08fc8a70 1235 while( p < buf + siglen && *p == 0 )
mbedAustin 11:cada08fc8a70 1236 p++;
mbedAustin 11:cada08fc8a70 1237
mbedAustin 11:cada08fc8a70 1238 if( p == buf + siglen ||
mbedAustin 11:cada08fc8a70 1239 *p++ != 0x01 )
mbedAustin 11:cada08fc8a70 1240 {
mbedAustin 11:cada08fc8a70 1241 mbedtls_md_free( &md_ctx );
mbedAustin 11:cada08fc8a70 1242 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
mbedAustin 11:cada08fc8a70 1243 }
mbedAustin 11:cada08fc8a70 1244
mbedAustin 11:cada08fc8a70 1245 /* Actual salt len */
mbedAustin 11:cada08fc8a70 1246 slen -= p - buf;
mbedAustin 11:cada08fc8a70 1247
mbedAustin 11:cada08fc8a70 1248 if( expected_salt_len != MBEDTLS_RSA_SALT_LEN_ANY &&
mbedAustin 11:cada08fc8a70 1249 slen != (size_t) expected_salt_len )
mbedAustin 11:cada08fc8a70 1250 {
mbedAustin 11:cada08fc8a70 1251 mbedtls_md_free( &md_ctx );
mbedAustin 11:cada08fc8a70 1252 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
mbedAustin 11:cada08fc8a70 1253 }
mbedAustin 11:cada08fc8a70 1254
mbedAustin 11:cada08fc8a70 1255 // Generate H = Hash( M' )
mbedAustin 11:cada08fc8a70 1256 //
mbedAustin 11:cada08fc8a70 1257 mbedtls_md_starts( &md_ctx );
mbedAustin 11:cada08fc8a70 1258 mbedtls_md_update( &md_ctx, zeros, 8 );
mbedAustin 11:cada08fc8a70 1259 mbedtls_md_update( &md_ctx, hash, hashlen );
mbedAustin 11:cada08fc8a70 1260 mbedtls_md_update( &md_ctx, p, slen );
mbedAustin 11:cada08fc8a70 1261 mbedtls_md_finish( &md_ctx, result );
mbedAustin 11:cada08fc8a70 1262
mbedAustin 11:cada08fc8a70 1263 mbedtls_md_free( &md_ctx );
mbedAustin 11:cada08fc8a70 1264
mbedAustin 11:cada08fc8a70 1265 if( memcmp( p + slen, result, hlen ) == 0 )
mbedAustin 11:cada08fc8a70 1266 return( 0 );
mbedAustin 11:cada08fc8a70 1267 else
mbedAustin 11:cada08fc8a70 1268 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
mbedAustin 11:cada08fc8a70 1269 }
mbedAustin 11:cada08fc8a70 1270
mbedAustin 11:cada08fc8a70 1271 /*
mbedAustin 11:cada08fc8a70 1272 * Simplified PKCS#1 v2.1 RSASSA-PSS-VERIFY function
mbedAustin 11:cada08fc8a70 1273 */
mbedAustin 11:cada08fc8a70 1274 int mbedtls_rsa_rsassa_pss_verify( mbedtls_rsa_context *ctx,
mbedAustin 11:cada08fc8a70 1275 int (*f_rng)(void *, unsigned char *, size_t),
mbedAustin 11:cada08fc8a70 1276 void *p_rng,
mbedAustin 11:cada08fc8a70 1277 int mode,
mbedAustin 11:cada08fc8a70 1278 mbedtls_md_type_t md_alg,
mbedAustin 11:cada08fc8a70 1279 unsigned int hashlen,
mbedAustin 11:cada08fc8a70 1280 const unsigned char *hash,
mbedAustin 11:cada08fc8a70 1281 const unsigned char *sig )
mbedAustin 11:cada08fc8a70 1282 {
mbedAustin 11:cada08fc8a70 1283 mbedtls_md_type_t mgf1_hash_id = ( ctx->hash_id != MBEDTLS_MD_NONE )
mbedAustin 11:cada08fc8a70 1284 ? (mbedtls_md_type_t) ctx->hash_id
mbedAustin 11:cada08fc8a70 1285 : md_alg;
mbedAustin 11:cada08fc8a70 1286
mbedAustin 11:cada08fc8a70 1287 return( mbedtls_rsa_rsassa_pss_verify_ext( ctx, f_rng, p_rng, mode,
mbedAustin 11:cada08fc8a70 1288 md_alg, hashlen, hash,
mbedAustin 11:cada08fc8a70 1289 mgf1_hash_id, MBEDTLS_RSA_SALT_LEN_ANY,
mbedAustin 11:cada08fc8a70 1290 sig ) );
mbedAustin 11:cada08fc8a70 1291
mbedAustin 11:cada08fc8a70 1292 }
mbedAustin 11:cada08fc8a70 1293 #endif /* MBEDTLS_PKCS1_V21 */
mbedAustin 11:cada08fc8a70 1294
mbedAustin 11:cada08fc8a70 1295 #if defined(MBEDTLS_PKCS1_V15)
mbedAustin 11:cada08fc8a70 1296 /*
mbedAustin 11:cada08fc8a70 1297 * Implementation of the PKCS#1 v2.1 RSASSA-PKCS1-v1_5-VERIFY function
mbedAustin 11:cada08fc8a70 1298 */
mbedAustin 11:cada08fc8a70 1299 int mbedtls_rsa_rsassa_pkcs1_v15_verify( mbedtls_rsa_context *ctx,
mbedAustin 11:cada08fc8a70 1300 int (*f_rng)(void *, unsigned char *, size_t),
mbedAustin 11:cada08fc8a70 1301 void *p_rng,
mbedAustin 11:cada08fc8a70 1302 int mode,
mbedAustin 11:cada08fc8a70 1303 mbedtls_md_type_t md_alg,
mbedAustin 11:cada08fc8a70 1304 unsigned int hashlen,
mbedAustin 11:cada08fc8a70 1305 const unsigned char *hash,
mbedAustin 11:cada08fc8a70 1306 const unsigned char *sig )
mbedAustin 11:cada08fc8a70 1307 {
mbedAustin 11:cada08fc8a70 1308 int ret;
mbedAustin 11:cada08fc8a70 1309 size_t len, siglen, asn1_len;
mbedAustin 11:cada08fc8a70 1310 unsigned char *p, *end;
mbedAustin 11:cada08fc8a70 1311 unsigned char buf[MBEDTLS_MPI_MAX_SIZE];
mbedAustin 11:cada08fc8a70 1312 mbedtls_md_type_t msg_md_alg;
mbedAustin 11:cada08fc8a70 1313 const mbedtls_md_info_t *md_info;
mbedAustin 11:cada08fc8a70 1314 mbedtls_asn1_buf oid;
mbedAustin 11:cada08fc8a70 1315
mbedAustin 11:cada08fc8a70 1316 if( mode == MBEDTLS_RSA_PRIVATE && ctx->padding != MBEDTLS_RSA_PKCS_V15 )
mbedAustin 11:cada08fc8a70 1317 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 1318
mbedAustin 11:cada08fc8a70 1319 siglen = ctx->len;
mbedAustin 11:cada08fc8a70 1320
mbedAustin 11:cada08fc8a70 1321 if( siglen < 16 || siglen > sizeof( buf ) )
mbedAustin 11:cada08fc8a70 1322 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 1323
mbedAustin 11:cada08fc8a70 1324 ret = ( mode == MBEDTLS_RSA_PUBLIC )
mbedAustin 11:cada08fc8a70 1325 ? mbedtls_rsa_public( ctx, sig, buf )
mbedAustin 11:cada08fc8a70 1326 : mbedtls_rsa_private( ctx, f_rng, p_rng, sig, buf );
mbedAustin 11:cada08fc8a70 1327
mbedAustin 11:cada08fc8a70 1328 if( ret != 0 )
mbedAustin 11:cada08fc8a70 1329 return( ret );
mbedAustin 11:cada08fc8a70 1330
mbedAustin 11:cada08fc8a70 1331 p = buf;
mbedAustin 11:cada08fc8a70 1332
mbedAustin 11:cada08fc8a70 1333 if( *p++ != 0 || *p++ != MBEDTLS_RSA_SIGN )
mbedAustin 11:cada08fc8a70 1334 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
mbedAustin 11:cada08fc8a70 1335
mbedAustin 11:cada08fc8a70 1336 while( *p != 0 )
mbedAustin 11:cada08fc8a70 1337 {
mbedAustin 11:cada08fc8a70 1338 if( p >= buf + siglen - 1 || *p != 0xFF )
mbedAustin 11:cada08fc8a70 1339 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
mbedAustin 11:cada08fc8a70 1340 p++;
mbedAustin 11:cada08fc8a70 1341 }
mbedAustin 11:cada08fc8a70 1342 p++;
mbedAustin 11:cada08fc8a70 1343
mbedAustin 11:cada08fc8a70 1344 len = siglen - ( p - buf );
mbedAustin 11:cada08fc8a70 1345
mbedAustin 11:cada08fc8a70 1346 if( len == hashlen && md_alg == MBEDTLS_MD_NONE )
mbedAustin 11:cada08fc8a70 1347 {
mbedAustin 11:cada08fc8a70 1348 if( memcmp( p, hash, hashlen ) == 0 )
mbedAustin 11:cada08fc8a70 1349 return( 0 );
mbedAustin 11:cada08fc8a70 1350 else
mbedAustin 11:cada08fc8a70 1351 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
mbedAustin 11:cada08fc8a70 1352 }
mbedAustin 11:cada08fc8a70 1353
mbedAustin 11:cada08fc8a70 1354 md_info = mbedtls_md_info_from_type( md_alg );
mbedAustin 11:cada08fc8a70 1355 if( md_info == NULL )
mbedAustin 11:cada08fc8a70 1356 return( MBEDTLS_ERR_RSA_BAD_INPUT_DATA );
mbedAustin 11:cada08fc8a70 1357 hashlen = mbedtls_md_get_size( md_info );
mbedAustin 11:cada08fc8a70 1358
mbedAustin 11:cada08fc8a70 1359 end = p + len;
mbedAustin 11:cada08fc8a70 1360
mbedAustin 11:cada08fc8a70 1361 // Parse the ASN.1 structure inside the PKCS#1 v1.5 structure
mbedAustin 11:cada08fc8a70 1362 //
mbedAustin 11:cada08fc8a70 1363 if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len,
mbedAustin 11:cada08fc8a70 1364 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
mbedAustin 11:cada08fc8a70 1365 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
mbedAustin 11:cada08fc8a70 1366
mbedAustin 11:cada08fc8a70 1367 if( asn1_len + 2 != len )
mbedAustin 11:cada08fc8a70 1368 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
mbedAustin 11:cada08fc8a70 1369
mbedAustin 11:cada08fc8a70 1370 if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len,
mbedAustin 11:cada08fc8a70 1371 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
mbedAustin 11:cada08fc8a70 1372 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
mbedAustin 11:cada08fc8a70 1373
mbedAustin 11:cada08fc8a70 1374 if( asn1_len + 6 + hashlen != len )
mbedAustin 11:cada08fc8a70 1375 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
mbedAustin 11:cada08fc8a70 1376
mbedAustin 11:cada08fc8a70 1377 if( ( ret = mbedtls_asn1_get_tag( &p, end, &oid.len, MBEDTLS_ASN1_OID ) ) != 0 )
mbedAustin 11:cada08fc8a70 1378 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
mbedAustin 11:cada08fc8a70 1379
mbedAustin 11:cada08fc8a70 1380 oid.p = p;
mbedAustin 11:cada08fc8a70 1381 p += oid.len;
mbedAustin 11:cada08fc8a70 1382
mbedAustin 11:cada08fc8a70 1383 if( mbedtls_oid_get_md_alg( &oid, &msg_md_alg ) != 0 )
mbedAustin 11:cada08fc8a70 1384 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
mbedAustin 11:cada08fc8a70 1385
mbedAustin 11:cada08fc8a70 1386 if( md_alg != msg_md_alg )
mbedAustin 11:cada08fc8a70 1387 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
mbedAustin 11:cada08fc8a70 1388
mbedAustin 11:cada08fc8a70 1389 /*
mbedAustin 11:cada08fc8a70 1390 * assume the algorithm parameters must be NULL
mbedAustin 11:cada08fc8a70 1391 */
mbedAustin 11:cada08fc8a70 1392 if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len, MBEDTLS_ASN1_NULL ) ) != 0 )
mbedAustin 11:cada08fc8a70 1393 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
mbedAustin 11:cada08fc8a70 1394
mbedAustin 11:cada08fc8a70 1395 if( ( ret = mbedtls_asn1_get_tag( &p, end, &asn1_len, MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
mbedAustin 11:cada08fc8a70 1396 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
mbedAustin 11:cada08fc8a70 1397
mbedAustin 11:cada08fc8a70 1398 if( asn1_len != hashlen )
mbedAustin 11:cada08fc8a70 1399 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
mbedAustin 11:cada08fc8a70 1400
mbedAustin 11:cada08fc8a70 1401 if( memcmp( p, hash, hashlen ) != 0 )
mbedAustin 11:cada08fc8a70 1402 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
mbedAustin 11:cada08fc8a70 1403
mbedAustin 11:cada08fc8a70 1404 p += hashlen;
mbedAustin 11:cada08fc8a70 1405
mbedAustin 11:cada08fc8a70 1406 if( p != end )
mbedAustin 11:cada08fc8a70 1407 return( MBEDTLS_ERR_RSA_VERIFY_FAILED );
mbedAustin 11:cada08fc8a70 1408
mbedAustin 11:cada08fc8a70 1409 return( 0 );
mbedAustin 11:cada08fc8a70 1410 }
mbedAustin 11:cada08fc8a70 1411 #endif /* MBEDTLS_PKCS1_V15 */
mbedAustin 11:cada08fc8a70 1412
mbedAustin 11:cada08fc8a70 1413 /*
mbedAustin 11:cada08fc8a70 1414 * Do an RSA operation and check the message digest
mbedAustin 11:cada08fc8a70 1415 */
mbedAustin 11:cada08fc8a70 1416 int mbedtls_rsa_pkcs1_verify( mbedtls_rsa_context *ctx,
mbedAustin 11:cada08fc8a70 1417 int (*f_rng)(void *, unsigned char *, size_t),
mbedAustin 11:cada08fc8a70 1418 void *p_rng,
mbedAustin 11:cada08fc8a70 1419 int mode,
mbedAustin 11:cada08fc8a70 1420 mbedtls_md_type_t md_alg,
mbedAustin 11:cada08fc8a70 1421 unsigned int hashlen,
mbedAustin 11:cada08fc8a70 1422 const unsigned char *hash,
mbedAustin 11:cada08fc8a70 1423 const unsigned char *sig )
mbedAustin 11:cada08fc8a70 1424 {
mbedAustin 11:cada08fc8a70 1425 switch( ctx->padding )
mbedAustin 11:cada08fc8a70 1426 {
mbedAustin 11:cada08fc8a70 1427 #if defined(MBEDTLS_PKCS1_V15)
mbedAustin 11:cada08fc8a70 1428 case MBEDTLS_RSA_PKCS_V15:
mbedAustin 11:cada08fc8a70 1429 return mbedtls_rsa_rsassa_pkcs1_v15_verify( ctx, f_rng, p_rng, mode, md_alg,
mbedAustin 11:cada08fc8a70 1430 hashlen, hash, sig );
mbedAustin 11:cada08fc8a70 1431 #endif
mbedAustin 11:cada08fc8a70 1432
mbedAustin 11:cada08fc8a70 1433 #if defined(MBEDTLS_PKCS1_V21)
mbedAustin 11:cada08fc8a70 1434 case MBEDTLS_RSA_PKCS_V21:
mbedAustin 11:cada08fc8a70 1435 return mbedtls_rsa_rsassa_pss_verify( ctx, f_rng, p_rng, mode, md_alg,
mbedAustin 11:cada08fc8a70 1436 hashlen, hash, sig );
mbedAustin 11:cada08fc8a70 1437 #endif
mbedAustin 11:cada08fc8a70 1438
mbedAustin 11:cada08fc8a70 1439 default:
mbedAustin 11:cada08fc8a70 1440 return( MBEDTLS_ERR_RSA_INVALID_PADDING );
mbedAustin 11:cada08fc8a70 1441 }
mbedAustin 11:cada08fc8a70 1442 }
mbedAustin 11:cada08fc8a70 1443
mbedAustin 11:cada08fc8a70 1444 /*
mbedAustin 11:cada08fc8a70 1445 * Copy the components of an RSA key
mbedAustin 11:cada08fc8a70 1446 */
mbedAustin 11:cada08fc8a70 1447 int mbedtls_rsa_copy( mbedtls_rsa_context *dst, const mbedtls_rsa_context *src )
mbedAustin 11:cada08fc8a70 1448 {
mbedAustin 11:cada08fc8a70 1449 int ret;
mbedAustin 11:cada08fc8a70 1450
mbedAustin 11:cada08fc8a70 1451 dst->ver = src->ver;
mbedAustin 11:cada08fc8a70 1452 dst->len = src->len;
mbedAustin 11:cada08fc8a70 1453
mbedAustin 11:cada08fc8a70 1454 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->N, &src->N ) );
mbedAustin 11:cada08fc8a70 1455 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->E, &src->E ) );
mbedAustin 11:cada08fc8a70 1456
mbedAustin 11:cada08fc8a70 1457 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->D, &src->D ) );
mbedAustin 11:cada08fc8a70 1458 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->P, &src->P ) );
mbedAustin 11:cada08fc8a70 1459 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Q, &src->Q ) );
mbedAustin 11:cada08fc8a70 1460 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->DP, &src->DP ) );
mbedAustin 11:cada08fc8a70 1461 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->DQ, &src->DQ ) );
mbedAustin 11:cada08fc8a70 1462 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->QP, &src->QP ) );
mbedAustin 11:cada08fc8a70 1463
mbedAustin 11:cada08fc8a70 1464 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RN, &src->RN ) );
mbedAustin 11:cada08fc8a70 1465 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RP, &src->RP ) );
mbedAustin 11:cada08fc8a70 1466 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->RQ, &src->RQ ) );
mbedAustin 11:cada08fc8a70 1467
mbedAustin 11:cada08fc8a70 1468 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Vi, &src->Vi ) );
mbedAustin 11:cada08fc8a70 1469 MBEDTLS_MPI_CHK( mbedtls_mpi_copy( &dst->Vf, &src->Vf ) );
mbedAustin 11:cada08fc8a70 1470
mbedAustin 11:cada08fc8a70 1471 dst->padding = src->padding;
mbedAustin 11:cada08fc8a70 1472 dst->hash_id = src->hash_id;
mbedAustin 11:cada08fc8a70 1473
mbedAustin 11:cada08fc8a70 1474 cleanup:
mbedAustin 11:cada08fc8a70 1475 if( ret != 0 )
mbedAustin 11:cada08fc8a70 1476 mbedtls_rsa_free( dst );
mbedAustin 11:cada08fc8a70 1477
mbedAustin 11:cada08fc8a70 1478 return( ret );
mbedAustin 11:cada08fc8a70 1479 }
mbedAustin 11:cada08fc8a70 1480
mbedAustin 11:cada08fc8a70 1481 /*
mbedAustin 11:cada08fc8a70 1482 * Free the components of an RSA key
mbedAustin 11:cada08fc8a70 1483 */
mbedAustin 11:cada08fc8a70 1484 void mbedtls_rsa_free( mbedtls_rsa_context *ctx )
mbedAustin 11:cada08fc8a70 1485 {
mbedAustin 11:cada08fc8a70 1486 mbedtls_mpi_free( &ctx->Vi ); mbedtls_mpi_free( &ctx->Vf );
mbedAustin 11:cada08fc8a70 1487 mbedtls_mpi_free( &ctx->RQ ); mbedtls_mpi_free( &ctx->RP ); mbedtls_mpi_free( &ctx->RN );
mbedAustin 11:cada08fc8a70 1488 mbedtls_mpi_free( &ctx->QP ); mbedtls_mpi_free( &ctx->DQ ); mbedtls_mpi_free( &ctx->DP );
mbedAustin 11:cada08fc8a70 1489 mbedtls_mpi_free( &ctx->Q ); mbedtls_mpi_free( &ctx->P ); mbedtls_mpi_free( &ctx->D );
mbedAustin 11:cada08fc8a70 1490 mbedtls_mpi_free( &ctx->E ); mbedtls_mpi_free( &ctx->N );
mbedAustin 11:cada08fc8a70 1491
mbedAustin 11:cada08fc8a70 1492 #if defined(MBEDTLS_THREADING_C)
mbedAustin 11:cada08fc8a70 1493 mbedtls_mutex_free( &ctx->mutex );
mbedAustin 11:cada08fc8a70 1494 #endif
mbedAustin 11:cada08fc8a70 1495 }
mbedAustin 11:cada08fc8a70 1496
mbedAustin 11:cada08fc8a70 1497 #if defined(MBEDTLS_SELF_TEST)
mbedAustin 11:cada08fc8a70 1498
mbedAustin 11:cada08fc8a70 1499 #include "mbedtls/sha1.h"
mbedAustin 11:cada08fc8a70 1500
mbedAustin 11:cada08fc8a70 1501 /*
mbedAustin 11:cada08fc8a70 1502 * Example RSA-1024 keypair, for test purposes
mbedAustin 11:cada08fc8a70 1503 */
mbedAustin 11:cada08fc8a70 1504 #define KEY_LEN 128
mbedAustin 11:cada08fc8a70 1505
mbedAustin 11:cada08fc8a70 1506 #define RSA_N "9292758453063D803DD603D5E777D788" \
mbedAustin 11:cada08fc8a70 1507 "8ED1D5BF35786190FA2F23EBC0848AEA" \
mbedAustin 11:cada08fc8a70 1508 "DDA92CA6C3D80B32C4D109BE0F36D6AE" \
mbedAustin 11:cada08fc8a70 1509 "7130B9CED7ACDF54CFC7555AC14EEBAB" \
mbedAustin 11:cada08fc8a70 1510 "93A89813FBF3C4F8066D2D800F7C38A8" \
mbedAustin 11:cada08fc8a70 1511 "1AE31942917403FF4946B0A83D3D3E05" \
mbedAustin 11:cada08fc8a70 1512 "EE57C6F5F5606FB5D4BC6CD34EE0801A" \
mbedAustin 11:cada08fc8a70 1513 "5E94BB77B07507233A0BC7BAC8F90F79"
mbedAustin 11:cada08fc8a70 1514
mbedAustin 11:cada08fc8a70 1515 #define RSA_E "10001"
mbedAustin 11:cada08fc8a70 1516
mbedAustin 11:cada08fc8a70 1517 #define RSA_D "24BF6185468786FDD303083D25E64EFC" \
mbedAustin 11:cada08fc8a70 1518 "66CA472BC44D253102F8B4A9D3BFA750" \
mbedAustin 11:cada08fc8a70 1519 "91386C0077937FE33FA3252D28855837" \
mbedAustin 11:cada08fc8a70 1520 "AE1B484A8A9A45F7EE8C0C634F99E8CD" \
mbedAustin 11:cada08fc8a70 1521 "DF79C5CE07EE72C7F123142198164234" \
mbedAustin 11:cada08fc8a70 1522 "CABB724CF78B8173B9F880FC86322407" \
mbedAustin 11:cada08fc8a70 1523 "AF1FEDFDDE2BEB674CA15F3E81A1521E" \
mbedAustin 11:cada08fc8a70 1524 "071513A1E85B5DFA031F21ECAE91A34D"
mbedAustin 11:cada08fc8a70 1525
mbedAustin 11:cada08fc8a70 1526 #define RSA_P "C36D0EB7FCD285223CFB5AABA5BDA3D8" \
mbedAustin 11:cada08fc8a70 1527 "2C01CAD19EA484A87EA4377637E75500" \
mbedAustin 11:cada08fc8a70 1528 "FCB2005C5C7DD6EC4AC023CDA285D796" \
mbedAustin 11:cada08fc8a70 1529 "C3D9E75E1EFC42488BB4F1D13AC30A57"
mbedAustin 11:cada08fc8a70 1530
mbedAustin 11:cada08fc8a70 1531 #define RSA_Q "C000DF51A7C77AE8D7C7370C1FF55B69" \
mbedAustin 11:cada08fc8a70 1532 "E211C2B9E5DB1ED0BF61D0D9899620F4" \
mbedAustin 11:cada08fc8a70 1533 "910E4168387E3C30AA1E00C339A79508" \
mbedAustin 11:cada08fc8a70 1534 "8452DD96A9A5EA5D9DCA68DA636032AF"
mbedAustin 11:cada08fc8a70 1535
mbedAustin 11:cada08fc8a70 1536 #define RSA_DP "C1ACF567564274FB07A0BBAD5D26E298" \
mbedAustin 11:cada08fc8a70 1537 "3C94D22288ACD763FD8E5600ED4A702D" \
mbedAustin 11:cada08fc8a70 1538 "F84198A5F06C2E72236AE490C93F07F8" \
mbedAustin 11:cada08fc8a70 1539 "3CC559CD27BC2D1CA488811730BB5725"
mbedAustin 11:cada08fc8a70 1540
mbedAustin 11:cada08fc8a70 1541 #define RSA_DQ "4959CBF6F8FEF750AEE6977C155579C7" \
mbedAustin 11:cada08fc8a70 1542 "D8AAEA56749EA28623272E4F7D0592AF" \
mbedAustin 11:cada08fc8a70 1543 "7C1F1313CAC9471B5C523BFE592F517B" \
mbedAustin 11:cada08fc8a70 1544 "407A1BD76C164B93DA2D32A383E58357"
mbedAustin 11:cada08fc8a70 1545
mbedAustin 11:cada08fc8a70 1546 #define RSA_QP "9AE7FBC99546432DF71896FC239EADAE" \
mbedAustin 11:cada08fc8a70 1547 "F38D18D2B2F0E2DD275AA977E2BF4411" \
mbedAustin 11:cada08fc8a70 1548 "F5A3B2A5D33605AEBBCCBA7FEB9F2D2F" \
mbedAustin 11:cada08fc8a70 1549 "A74206CEC169D74BF5A8C50D6F48EA08"
mbedAustin 11:cada08fc8a70 1550
mbedAustin 11:cada08fc8a70 1551 #define PT_LEN 24
mbedAustin 11:cada08fc8a70 1552 #define RSA_PT "\xAA\xBB\xCC\x03\x02\x01\x00\xFF\xFF\xFF\xFF\xFF" \
mbedAustin 11:cada08fc8a70 1553 "\x11\x22\x33\x0A\x0B\x0C\xCC\xDD\xDD\xDD\xDD\xDD"
mbedAustin 11:cada08fc8a70 1554
mbedAustin 11:cada08fc8a70 1555 #if defined(MBEDTLS_PKCS1_V15)
mbedAustin 11:cada08fc8a70 1556 static int myrand( void *rng_state, unsigned char *output, size_t len )
mbedAustin 11:cada08fc8a70 1557 {
mbedAustin 11:cada08fc8a70 1558 #if !defined(__OpenBSD__)
mbedAustin 11:cada08fc8a70 1559 size_t i;
mbedAustin 11:cada08fc8a70 1560
mbedAustin 11:cada08fc8a70 1561 if( rng_state != NULL )
mbedAustin 11:cada08fc8a70 1562 rng_state = NULL;
mbedAustin 11:cada08fc8a70 1563
mbedAustin 11:cada08fc8a70 1564 for( i = 0; i < len; ++i )
mbedAustin 11:cada08fc8a70 1565 output[i] = rand();
mbedAustin 11:cada08fc8a70 1566 #else
mbedAustin 11:cada08fc8a70 1567 if( rng_state != NULL )
mbedAustin 11:cada08fc8a70 1568 rng_state = NULL;
mbedAustin 11:cada08fc8a70 1569
mbedAustin 11:cada08fc8a70 1570 arc4random_buf( output, len );
mbedAustin 11:cada08fc8a70 1571 #endif /* !OpenBSD */
mbedAustin 11:cada08fc8a70 1572
mbedAustin 11:cada08fc8a70 1573 return( 0 );
mbedAustin 11:cada08fc8a70 1574 }
mbedAustin 11:cada08fc8a70 1575 #endif /* MBEDTLS_PKCS1_V15 */
mbedAustin 11:cada08fc8a70 1576
mbedAustin 11:cada08fc8a70 1577 /*
mbedAustin 11:cada08fc8a70 1578 * Checkup routine
mbedAustin 11:cada08fc8a70 1579 */
mbedAustin 11:cada08fc8a70 1580 int mbedtls_rsa_self_test( int verbose )
mbedAustin 11:cada08fc8a70 1581 {
mbedAustin 11:cada08fc8a70 1582 int ret = 0;
mbedAustin 11:cada08fc8a70 1583 #if defined(MBEDTLS_PKCS1_V15)
mbedAustin 11:cada08fc8a70 1584 size_t len;
mbedAustin 11:cada08fc8a70 1585 mbedtls_rsa_context rsa;
mbedAustin 11:cada08fc8a70 1586 unsigned char rsa_plaintext[PT_LEN];
mbedAustin 11:cada08fc8a70 1587 unsigned char rsa_decrypted[PT_LEN];
mbedAustin 11:cada08fc8a70 1588 unsigned char rsa_ciphertext[KEY_LEN];
mbedAustin 11:cada08fc8a70 1589 #if defined(MBEDTLS_SHA1_C)
mbedAustin 11:cada08fc8a70 1590 unsigned char sha1sum[20];
mbedAustin 11:cada08fc8a70 1591 #endif
mbedAustin 11:cada08fc8a70 1592
mbedAustin 11:cada08fc8a70 1593 mbedtls_rsa_init( &rsa, MBEDTLS_RSA_PKCS_V15, 0 );
mbedAustin 11:cada08fc8a70 1594
mbedAustin 11:cada08fc8a70 1595 rsa.len = KEY_LEN;
mbedAustin 11:cada08fc8a70 1596 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.N , 16, RSA_N ) );
mbedAustin 11:cada08fc8a70 1597 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.E , 16, RSA_E ) );
mbedAustin 11:cada08fc8a70 1598 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.D , 16, RSA_D ) );
mbedAustin 11:cada08fc8a70 1599 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.P , 16, RSA_P ) );
mbedAustin 11:cada08fc8a70 1600 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.Q , 16, RSA_Q ) );
mbedAustin 11:cada08fc8a70 1601 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.DP, 16, RSA_DP ) );
mbedAustin 11:cada08fc8a70 1602 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.DQ, 16, RSA_DQ ) );
mbedAustin 11:cada08fc8a70 1603 MBEDTLS_MPI_CHK( mbedtls_mpi_read_string( &rsa.QP, 16, RSA_QP ) );
mbedAustin 11:cada08fc8a70 1604
mbedAustin 11:cada08fc8a70 1605 if( verbose != 0 )
mbedAustin 11:cada08fc8a70 1606 mbedtls_printf( " RSA key validation: " );
mbedAustin 11:cada08fc8a70 1607
mbedAustin 11:cada08fc8a70 1608 if( mbedtls_rsa_check_pubkey( &rsa ) != 0 ||
mbedAustin 11:cada08fc8a70 1609 mbedtls_rsa_check_privkey( &rsa ) != 0 )
mbedAustin 11:cada08fc8a70 1610 {
mbedAustin 11:cada08fc8a70 1611 if( verbose != 0 )
mbedAustin 11:cada08fc8a70 1612 mbedtls_printf( "failed\n" );
mbedAustin 11:cada08fc8a70 1613
mbedAustin 11:cada08fc8a70 1614 return( 1 );
mbedAustin 11:cada08fc8a70 1615 }
mbedAustin 11:cada08fc8a70 1616
mbedAustin 11:cada08fc8a70 1617 if( verbose != 0 )
mbedAustin 11:cada08fc8a70 1618 mbedtls_printf( "passed\n PKCS#1 encryption : " );
mbedAustin 11:cada08fc8a70 1619
mbedAustin 11:cada08fc8a70 1620 memcpy( rsa_plaintext, RSA_PT, PT_LEN );
mbedAustin 11:cada08fc8a70 1621
mbedAustin 11:cada08fc8a70 1622 if( mbedtls_rsa_pkcs1_encrypt( &rsa, myrand, NULL, MBEDTLS_RSA_PUBLIC, PT_LEN,
mbedAustin 11:cada08fc8a70 1623 rsa_plaintext, rsa_ciphertext ) != 0 )
mbedAustin 11:cada08fc8a70 1624 {
mbedAustin 11:cada08fc8a70 1625 if( verbose != 0 )
mbedAustin 11:cada08fc8a70 1626 mbedtls_printf( "failed\n" );
mbedAustin 11:cada08fc8a70 1627
mbedAustin 11:cada08fc8a70 1628 return( 1 );
mbedAustin 11:cada08fc8a70 1629 }
mbedAustin 11:cada08fc8a70 1630
mbedAustin 11:cada08fc8a70 1631 if( verbose != 0 )
mbedAustin 11:cada08fc8a70 1632 mbedtls_printf( "passed\n PKCS#1 decryption : " );
mbedAustin 11:cada08fc8a70 1633
mbedAustin 11:cada08fc8a70 1634 if( mbedtls_rsa_pkcs1_decrypt( &rsa, myrand, NULL, MBEDTLS_RSA_PRIVATE, &len,
mbedAustin 11:cada08fc8a70 1635 rsa_ciphertext, rsa_decrypted,
mbedAustin 11:cada08fc8a70 1636 sizeof(rsa_decrypted) ) != 0 )
mbedAustin 11:cada08fc8a70 1637 {
mbedAustin 11:cada08fc8a70 1638 if( verbose != 0 )
mbedAustin 11:cada08fc8a70 1639 mbedtls_printf( "failed\n" );
mbedAustin 11:cada08fc8a70 1640
mbedAustin 11:cada08fc8a70 1641 return( 1 );
mbedAustin 11:cada08fc8a70 1642 }
mbedAustin 11:cada08fc8a70 1643
mbedAustin 11:cada08fc8a70 1644 if( memcmp( rsa_decrypted, rsa_plaintext, len ) != 0 )
mbedAustin 11:cada08fc8a70 1645 {
mbedAustin 11:cada08fc8a70 1646 if( verbose != 0 )
mbedAustin 11:cada08fc8a70 1647 mbedtls_printf( "failed\n" );
mbedAustin 11:cada08fc8a70 1648
mbedAustin 11:cada08fc8a70 1649 return( 1 );
mbedAustin 11:cada08fc8a70 1650 }
mbedAustin 11:cada08fc8a70 1651
mbedAustin 11:cada08fc8a70 1652 if( verbose != 0 )
mbedAustin 11:cada08fc8a70 1653 mbedtls_printf( "passed\n" );
mbedAustin 11:cada08fc8a70 1654
mbedAustin 11:cada08fc8a70 1655 #if defined(MBEDTLS_SHA1_C)
mbedAustin 11:cada08fc8a70 1656 if( verbose != 0 )
mbedAustin 11:cada08fc8a70 1657 mbedtls_printf( "PKCS#1 data sign : " );
mbedAustin 11:cada08fc8a70 1658
mbedAustin 11:cada08fc8a70 1659 mbedtls_sha1( rsa_plaintext, PT_LEN, sha1sum );
mbedAustin 11:cada08fc8a70 1660
mbedAustin 11:cada08fc8a70 1661 if( mbedtls_rsa_pkcs1_sign( &rsa, myrand, NULL, MBEDTLS_RSA_PRIVATE, MBEDTLS_MD_SHA1, 0,
mbedAustin 11:cada08fc8a70 1662 sha1sum, rsa_ciphertext ) != 0 )
mbedAustin 11:cada08fc8a70 1663 {
mbedAustin 11:cada08fc8a70 1664 if( verbose != 0 )
mbedAustin 11:cada08fc8a70 1665 mbedtls_printf( "failed\n" );
mbedAustin 11:cada08fc8a70 1666
mbedAustin 11:cada08fc8a70 1667 return( 1 );
mbedAustin 11:cada08fc8a70 1668 }
mbedAustin 11:cada08fc8a70 1669
mbedAustin 11:cada08fc8a70 1670 if( verbose != 0 )
mbedAustin 11:cada08fc8a70 1671 mbedtls_printf( "passed\n PKCS#1 sig. verify: " );
mbedAustin 11:cada08fc8a70 1672
mbedAustin 11:cada08fc8a70 1673 if( mbedtls_rsa_pkcs1_verify( &rsa, NULL, NULL, MBEDTLS_RSA_PUBLIC, MBEDTLS_MD_SHA1, 0,
mbedAustin 11:cada08fc8a70 1674 sha1sum, rsa_ciphertext ) != 0 )
mbedAustin 11:cada08fc8a70 1675 {
mbedAustin 11:cada08fc8a70 1676 if( verbose != 0 )
mbedAustin 11:cada08fc8a70 1677 mbedtls_printf( "failed\n" );
mbedAustin 11:cada08fc8a70 1678
mbedAustin 11:cada08fc8a70 1679 return( 1 );
mbedAustin 11:cada08fc8a70 1680 }
mbedAustin 11:cada08fc8a70 1681
mbedAustin 11:cada08fc8a70 1682 if( verbose != 0 )
mbedAustin 11:cada08fc8a70 1683 mbedtls_printf( "passed\n" );
mbedAustin 11:cada08fc8a70 1684 #endif /* MBEDTLS_SHA1_C */
mbedAustin 11:cada08fc8a70 1685
mbedAustin 11:cada08fc8a70 1686 if( verbose != 0 )
mbedAustin 11:cada08fc8a70 1687 mbedtls_printf( "\n" );
mbedAustin 11:cada08fc8a70 1688
mbedAustin 11:cada08fc8a70 1689 cleanup:
mbedAustin 11:cada08fc8a70 1690 mbedtls_rsa_free( &rsa );
mbedAustin 11:cada08fc8a70 1691 #else /* MBEDTLS_PKCS1_V15 */
mbedAustin 11:cada08fc8a70 1692 ((void) verbose);
mbedAustin 11:cada08fc8a70 1693 #endif /* MBEDTLS_PKCS1_V15 */
mbedAustin 11:cada08fc8a70 1694 return( ret );
mbedAustin 11:cada08fc8a70 1695 }
mbedAustin 11:cada08fc8a70 1696
mbedAustin 11:cada08fc8a70 1697 #endif /* MBEDTLS_SELF_TEST */
mbedAustin 11:cada08fc8a70 1698
mbedAustin 11:cada08fc8a70 1699 #endif /* MBEDTLS_RSA_C */